k3s - Basics (#423)
Co-authored-by: Michael Grote <michael.grote@posteo.de> Reviewed-on: #423
This commit is contained in:
parent
9d621c4f9d
commit
135bd53414
183 changed files with 9132 additions and 25 deletions
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
type: kubernetes
|
||||
name: default
|
||||
|
||||
steps:
|
||||
|
|
|
@ -23,25 +23,6 @@ services:
|
|||
- intern
|
||||
|
||||
|
||||
# runner
|
||||
drone-runner-docker:
|
||||
volumes:
|
||||
- '/var/run/docker.sock:/var/run/docker.sock'
|
||||
environment:
|
||||
- DRONE_RPC_PROTO=http
|
||||
# container-name des servers
|
||||
- DRONE_RPC_HOST=drone-server
|
||||
- DRONE_RPC_SECRET={{ lookup('keepass', 'drone_rpc_secret', 'password') }}
|
||||
- DRONE_RUNNER_CAPACITY=4
|
||||
- DRONE_RUNNER_NAME=drone-runner
|
||||
ports:
|
||||
- '3000:3000'
|
||||
restart: always
|
||||
container_name: drone-runner
|
||||
image: 'drone/drone-runner-docker:latest'
|
||||
networks:
|
||||
- intern
|
||||
|
||||
######## Volumes ########
|
||||
volumes:
|
||||
data:
|
||||
|
|
|
@ -9,6 +9,8 @@ computerbase.de::Fotowettbewerb:
|
|||
computerbase.de::Screenshot-Wettbewerb
|
||||
computerbase.de::Sonntagsfrage:
|
||||
computerbase.de::Wochenrück- und Ausblick:
|
||||
computerbase.de::Twitter
|
||||
computerbase.de::Elon Musk
|
||||
facebook.com::Bridge returned error
|
||||
golem.de::Anzeige
|
||||
golem.de::Aus dem Verlag:
|
||||
|
@ -22,9 +24,13 @@ golem.de::Podcast
|
|||
golem.de::Sonst noch was?
|
||||
golem.de::Star Trek:
|
||||
golem.de::Tech Talks:
|
||||
golem.de::Twitter
|
||||
golem.de::Elon Musk
|
||||
golem.de::Wochenrückblick
|
||||
hardwareluxx.de::Der Hardwareluxx-Webwatch:
|
||||
hardwareluxx.de::Unsere Artikel der letzten Woche
|
||||
heise.de::Elon Musk
|
||||
heise.de::Twitter
|
||||
heise.de::Anzeige
|
||||
heise.de::Auslegungssache
|
||||
heise.de::Bit-Rauschen
|
||||
|
@ -141,6 +147,8 @@ stackoverflow.blog::Podcast
|
|||
stackoverflow.blog::The Overflow
|
||||
stadt-bremerhaven.de::Bundesliga
|
||||
stadt-bremerhaven.de::Disney+
|
||||
stadt-bremerhaven.de::Twitter
|
||||
stadt-bremerhaven.de::Elon Musk
|
||||
stadt-bremerhaven.de::eFootball
|
||||
stadt-bremerhaven.de::FIFA
|
||||
stadt-bremerhaven.de::Formel 1
|
||||
|
|
|
@ -22,6 +22,9 @@ services:
|
|||
ansible2.grote.lan:ansible2.grote.lan
|
||||
pve5.grote.lan:pve5.grote.lan
|
||||
dokuwiki2.grote.lan:dokuwiki2.grote.lan
|
||||
k3s1.grote.lan:k3s1.grote.lan
|
||||
k3s2.grote.lan:k3s2.grote.lan
|
||||
k3s3.grote.lan:k3s3.grote.lan
|
||||
gitea.grote.lan:gitea.grote.lan
|
||||
docker10.grote.lan:docker10.grote.lan
|
||||
dnsmasq.grote.lan:dnsmasq.grote.lan'
|
||||
|
|
|
@ -71,7 +71,7 @@ services:
|
|||
PHP_MEMORY_LIMIT: 1024M
|
||||
PHP_UPLOAD_LIMIT: 10G
|
||||
APACHE_DISABLE_REWRITE_IP: 1
|
||||
TRUSTED_PROXIES: "192.168.2.43" # docker10.grote.lan/traefik #prüfen
|
||||
TRUSTED_PROXIES: "192.168.2.43" # docker10.grote.lan/traefik
|
||||
volumes:
|
||||
- app:/var/www/html
|
||||
- data:/var/www/html/data
|
||||
|
|
95
group_vars/k3s.yml
Normal file
95
group_vars/k3s.yml
Normal file
|
@ -0,0 +1,95 @@
|
|||
---
|
||||
### mgrote.restic
|
||||
restic_folders_to_backup: "/ /var" # --one-file-system ist gesetzt, also werden weitere Dateisysteme nicht eingeschlossen, es sei denn sie werden hier explizit angegeben; https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files
|
||||
|
||||
### pandemonium1986.ansible-role-k9s
|
||||
k9s_version: "v0.26.7"
|
||||
|
||||
### mrlesmithjr.ansible-manage-lvm
|
||||
#lvm_groups:
|
||||
# - vgname: vg_gitea_data
|
||||
# disks:
|
||||
# - /dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1
|
||||
# create: true
|
||||
# lvnames:
|
||||
# - lvname: lv_gitea_data
|
||||
# size: +100%FREE
|
||||
# create: true
|
||||
# filesystem: xfs
|
||||
# mount: true
|
||||
# mntp: /var/lib/gitea
|
||||
#manage_lvm: true
|
||||
#pvresize_to_max: true
|
||||
|
||||
### oefenweb.ufw
|
||||
ufw_rules:
|
||||
# - rule: allow
|
||||
# to_port: 22
|
||||
# protocol: tcp
|
||||
# comment: 'ssh'
|
||||
# from_ip: 0.0.0.0/0
|
||||
# - rule: allow
|
||||
# to_port: 4949
|
||||
# protocol: tcp
|
||||
# comment: 'munin'
|
||||
# from_ip: 192.168.2.0/24
|
||||
# # https://rancher.com/docs/k3s/latest/en/installation/installation-requirements/
|
||||
# - rule: allow
|
||||
# to_port: 6443
|
||||
# protocol: tcp
|
||||
# comment: 'k8s-api-server'
|
||||
# from_ip: 192.168.2.0/24
|
||||
# - rule: allow
|
||||
# to_port: 2379
|
||||
# protocol: tcp
|
||||
# comment: 'k8s-embedded-etcd'
|
||||
# from_ip: 192.168.2.0/24
|
||||
# - rule: allow
|
||||
# to_port: 2380
|
||||
# protocol: tcp
|
||||
# comment: 'k8s-embedded-etcd'
|
||||
# from_ip: 192.168.2.0/24
|
||||
# - rule: allow
|
||||
# to_port: 10250
|
||||
# protocol: tcp
|
||||
# comment: 'k8s-kubelet-metrics'
|
||||
# from_ip: 192.168.2.0/24
|
||||
- rule: allow
|
||||
comment: 'k3s - alles offen'
|
||||
from_ip: 0.0.0.0/0
|
||||
### xanmanning.k3s
|
||||
k3s_state: installed
|
||||
k3s_airgap: false
|
||||
k3s_config_file: /etc/rancher/k3s/config.yaml
|
||||
k3s_build_cluster: true
|
||||
k3s_install_dir: /usr/local/bin
|
||||
k3s_etcd_datastore: true
|
||||
k3s_become: true
|
||||
k3s_use_experimental: true
|
||||
k3s_server:
|
||||
# siehe https://docs.k3s.io/reference/server-config
|
||||
# cli parameter OHNE -- am anfang
|
||||
write-kubeconfig-mode: '644'
|
||||
cluster-cidr: "10.42.0.0/16"
|
||||
service-cidr: "10.43.0.0/16"
|
||||
disable:
|
||||
- traefik
|
||||
- local-storage # disables local-path-provisioner
|
||||
|
||||
### mgrote.fluxcd
|
||||
flux_repo_url:
|
||||
flux_repo_host: git.mgrote.net
|
||||
flux_repo_host_port: 2222
|
||||
flux_repo_branch: master
|
||||
flux_repo_url_complete: ssh://gitea@git.mgrote.net:2222/mg/k3s-fluxcd.git
|
||||
flux_install_host: k3s1.grote.lan
|
||||
flux_homedir: /home/flux
|
||||
flux_path_ssh_dir: /home/flux/.ssh
|
||||
flux_user_group: flux
|
||||
flux_user: flux
|
||||
flux_download_url: https://github.com/fluxcd/flux2/releases/download/v0.35.0/flux_0.35.0_linux_amd64.tar.gz
|
||||
flux_path_bin: /usr/local/sbin
|
||||
flux_path_ssh_id_file: id_rsa
|
||||
flux_ssh_key_format: ed25519
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
flux_sync_interval: 1m
|
|
@ -28,8 +28,6 @@
|
|||
### mgrote.restic
|
||||
restic_folders_to_backup: "/ /var/lib/docker /mnt/httpd" # --one-file-system ist gesetzt, also werden weitere Dateisysteme nicht eingeschlossen, es sei denn sie werden hier explizit angegeben
|
||||
|
||||
# die vars noch in rolle übertragen mit beispiel
|
||||
|
||||
### mgrote.docker-compose-inline
|
||||
compose_owner: "docker-user"
|
||||
compose_group: "docker-user"
|
||||
|
|
3
host_vars/k3s1.grote.lan.yml
Normal file
3
host_vars/k3s1.grote.lan.yml
Normal file
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
### xanmanning.k3s
|
||||
k3s_control_node: true
|
3
host_vars/k3s2.grote.lan.yml
Normal file
3
host_vars/k3s2.grote.lan.yml
Normal file
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
### xanmanning.k3s
|
||||
k3s_control_node: true
|
3
host_vars/k3s3.grote.lan.yml
Normal file
3
host_vars/k3s3.grote.lan.yml
Normal file
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
### xanmanning.k3s
|
||||
k3s_control_node: true
|
|
@ -158,8 +158,8 @@
|
|||
|
||||
### mgrote.cv4pve-autosnap
|
||||
cv4pve_api_user: root@pam!cv4pve-autosnap
|
||||
cv4pve_api_token: "{{ lookup('keepass', 'cv4pve_api_token', 'password') }}"
|
||||
cv4pve_vmid: all,-127
|
||||
cv4pve_api_token: "{{ lookup('keepass', 'cv4pve_api_token_pve2', 'password') }}"
|
||||
cv4pve_vmid: all,-127,-112,-116,-101,-102,-106 # k3s* wieder in snaps aktivieren!
|
||||
cv4pve_keep_snapshots: 5
|
||||
cv4pve_dl_link: "https://github.com/Corsinvest/cv4pve-autosnap/releases/download/v1.10.0/cv4pve-autosnap-linux-x64.zip"
|
||||
|
||||
|
|
16
inventory
16
inventory
|
@ -18,6 +18,15 @@ all:
|
|||
docker:
|
||||
hosts:
|
||||
docker10.grote.lan:
|
||||
k3s:
|
||||
hosts:
|
||||
k3s1.grote.lan:
|
||||
k3s2.grote.lan:
|
||||
k3s3.grote.lan:
|
||||
vmtest:
|
||||
hosts:
|
||||
vm-test-2004.grote.lan:
|
||||
vm-test-2204.grote.lan:
|
||||
proxmox:
|
||||
hosts:
|
||||
pve5.grote.lan:
|
||||
|
@ -26,6 +35,10 @@ all:
|
|||
proxmoxprod:
|
||||
hosts:
|
||||
pve5.grote.lan:
|
||||
children:
|
||||
proxmoxtest:
|
||||
hosts:
|
||||
pve5-test.grote.lan:
|
||||
physical:
|
||||
hosts:
|
||||
pve5.grote.lan:
|
||||
|
@ -43,6 +56,9 @@ all:
|
|||
gitea.grote.lan:
|
||||
dnsmasq.grote.lan:
|
||||
docker10.grote.lan:
|
||||
k3s1.grote.lan:
|
||||
k3s2.grote.lan:
|
||||
k3s3.grote.lan:
|
||||
test:
|
||||
hosts:
|
||||
vm-test-2004.grote.lan:
|
||||
|
|
BIN
keepass_db.kdbx
BIN
keepass_db.kdbx
Binary file not shown.
9
playbooks/3_service/k3s.yml
Normal file
9
playbooks/3_service/k3s.yml
Normal file
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
- hosts: k3s
|
||||
roles:
|
||||
- { role: xanmanning.k3s, tags: "k3s" }
|
||||
- { role: mgrote.k8s_autocompletion, tags: "autocomp" }
|
||||
- { role: pandemonium1986.ansible-role-k9s, tags: "k9s", become: true }
|
||||
- { role: mgrote.fluxcd, tags: "flux", become: true }
|
||||
- { role: mgrote.k8s_misc, tags: "misc", become: true }
|
||||
- { role: mgrote.sealed-secrets, tags: "sealed-secrets", become: true }
|
4
playbooks/3_service/nfs.yml
Normal file
4
playbooks/3_service/nfs.yml
Normal file
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
- hosts: nfs
|
||||
roles:
|
||||
- { role: geerlingguy.nfs_server, tags: "nfs", become: true }
|
3
roles/geerlingguy.nfs_server/.ansible-lint
Normal file
3
roles/geerlingguy.nfs_server/.ansible-lint
Normal file
|
@ -0,0 +1,3 @@
|
|||
skip_list:
|
||||
- 'yaml'
|
||||
- 'role-name'
|
4
roles/geerlingguy.nfs_server/.github/FUNDING.yml
vendored
Normal file
4
roles/geerlingguy.nfs_server/.github/FUNDING.yml
vendored
Normal file
|
@ -0,0 +1,4 @@
|
|||
# These are supported funding model platforms
|
||||
---
|
||||
github: geerlingguy
|
||||
patreon: geerlingguy
|
57
roles/geerlingguy.nfs_server/.github/stale.yml
vendored
Normal file
57
roles/geerlingguy.nfs_server/.github/stale.yml
vendored
Normal file
|
@ -0,0 +1,57 @@
|
|||
# Configuration for probot-stale - https://github.com/probot/stale
|
||||
|
||||
# Number of days of inactivity before an Issue or Pull Request becomes stale
|
||||
daysUntilStale: 90
|
||||
|
||||
# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
|
||||
# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
|
||||
daysUntilClose: 30
|
||||
|
||||
# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled)
|
||||
onlyLabels: []
|
||||
|
||||
# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
|
||||
exemptLabels:
|
||||
- bug
|
||||
- pinned
|
||||
- security
|
||||
- planned
|
||||
|
||||
# Set to true to ignore issues in a project (defaults to false)
|
||||
exemptProjects: false
|
||||
|
||||
# Set to true to ignore issues in a milestone (defaults to false)
|
||||
exemptMilestones: false
|
||||
|
||||
# Set to true to ignore issues with an assignee (defaults to false)
|
||||
exemptAssignees: false
|
||||
|
||||
# Label to use when marking as stale
|
||||
staleLabel: stale
|
||||
|
||||
# Limit the number of actions per hour, from 1-30. Default is 30
|
||||
limitPerRun: 30
|
||||
|
||||
pulls:
|
||||
markComment: |-
|
||||
This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution!
|
||||
|
||||
Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark pull requests as stale.
|
||||
|
||||
unmarkComment: >-
|
||||
This pull request is no longer marked for closure.
|
||||
|
||||
closeComment: >-
|
||||
This pull request has been closed due to inactivity. If you feel this is in error, please reopen the pull request or file a new PR with the relevant details.
|
||||
|
||||
issues:
|
||||
markComment: |-
|
||||
This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
|
||||
|
||||
Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale.
|
||||
|
||||
unmarkComment: >-
|
||||
This issue is no longer marked for closure.
|
||||
|
||||
closeComment: >-
|
||||
This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details.
|
67
roles/geerlingguy.nfs_server/.github/workflows/ci.yml
vendored
Normal file
67
roles/geerlingguy.nfs_server/.github/workflows/ci.yml
vendored
Normal file
|
@ -0,0 +1,67 @@
|
|||
---
|
||||
name: CI
|
||||
'on':
|
||||
pull_request:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
schedule:
|
||||
- cron: "30 1 * * 3"
|
||||
|
||||
defaults:
|
||||
run:
|
||||
working-directory: 'geerlingguy.nfs'
|
||||
|
||||
jobs:
|
||||
|
||||
lint:
|
||||
name: Lint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check out the codebase.
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: 'geerlingguy.nfs'
|
||||
|
||||
- name: Set up Python 3.
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
|
||||
- name: Install test dependencies.
|
||||
run: pip3 install yamllint
|
||||
|
||||
- name: Lint code.
|
||||
run: |
|
||||
yamllint .
|
||||
|
||||
molecule:
|
||||
name: Molecule
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
distro:
|
||||
- rockylinux8
|
||||
- centos7
|
||||
- ubuntu2004
|
||||
|
||||
steps:
|
||||
- name: Check out the codebase.
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: 'geerlingguy.nfs'
|
||||
|
||||
- name: Set up Python 3.
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
|
||||
- name: Install test dependencies.
|
||||
run: pip3 install ansible molecule[docker] docker
|
||||
|
||||
- name: Run Molecule tests.
|
||||
run: molecule test
|
||||
env:
|
||||
PY_COLORS: '1'
|
||||
ANSIBLE_FORCE_COLOR: '1'
|
||||
MOLECULE_DISTRO: ${{ matrix.distro }}
|
40
roles/geerlingguy.nfs_server/.github/workflows/release.yml
vendored
Normal file
40
roles/geerlingguy.nfs_server/.github/workflows/release.yml
vendored
Normal file
|
@ -0,0 +1,40 @@
|
|||
---
|
||||
# This workflow requires a GALAXY_API_KEY secret present in the GitHub
|
||||
# repository or organization.
|
||||
#
|
||||
# See: https://github.com/marketplace/actions/publish-ansible-role-to-galaxy
|
||||
# See: https://github.com/ansible/galaxy/issues/46
|
||||
|
||||
name: Release
|
||||
'on':
|
||||
push:
|
||||
tags:
|
||||
- '*'
|
||||
|
||||
defaults:
|
||||
run:
|
||||
working-directory: 'geerlingguy.nfs'
|
||||
|
||||
jobs:
|
||||
|
||||
release:
|
||||
name: Release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check out the codebase.
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: 'geerlingguy.nfs'
|
||||
|
||||
- name: Set up Python 3.
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
|
||||
- name: Install Ansible.
|
||||
run: pip3 install ansible-core
|
||||
|
||||
- name: Trigger a new import on Galaxy.
|
||||
run: >-
|
||||
ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }}
|
||||
$(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)
|
5
roles/geerlingguy.nfs_server/.gitignore
vendored
Normal file
5
roles/geerlingguy.nfs_server/.gitignore
vendored
Normal file
|
@ -0,0 +1,5 @@
|
|||
*.retry
|
||||
*/__pycache__
|
||||
*.pyc
|
||||
.cache
|
||||
|
10
roles/geerlingguy.nfs_server/.yamllint
Normal file
10
roles/geerlingguy.nfs_server/.yamllint
Normal file
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
line-length:
|
||||
max: 120
|
||||
level: warning
|
||||
|
||||
ignore: |
|
||||
.github/stale.yml
|
20
roles/geerlingguy.nfs_server/LICENSE
Normal file
20
roles/geerlingguy.nfs_server/LICENSE
Normal file
|
@ -0,0 +1,20 @@
|
|||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2017 Jeff Geerling
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
this software and associated documentation files (the "Software"), to deal in
|
||||
the Software without restriction, including without limitation the rights to
|
||||
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
40
roles/geerlingguy.nfs_server/README.md
Normal file
40
roles/geerlingguy.nfs_server/README.md
Normal file
|
@ -0,0 +1,40 @@
|
|||
# Ansible Role: NFS
|
||||
|
||||
[![CI](https://github.com/geerlingguy/ansible-role-nfs/workflows/CI/badge.svg?event=push)](https://github.com/geerlingguy/ansible-role-nfs/actions?query=workflow%3ACI)
|
||||
|
||||
Installs NFS utilities on RedHat/CentOS or Debian/Ubuntu.
|
||||
|
||||
## Requirements
|
||||
|
||||
None.
|
||||
|
||||
## Role Variables
|
||||
|
||||
Available variables are listed below, along with default values (see `defaults/main.yml`):
|
||||
|
||||
nfs_exports: []
|
||||
|
||||
A list of exports which will be placed in the `/etc/exports` file. See Ubuntu's simple [Network File System (NFS)](https://ubuntu.com/server/docs/service-nfs) guide for more info and examples. (Simple example: `nfs_exports: [ "/home/public *(rw,sync,no_root_squash)" ]`).
|
||||
|
||||
nfs_rpcbind_state: started
|
||||
nfs_rpcbind_enabled: true
|
||||
|
||||
(RedHat/CentOS/Fedora only) The state of the `rpcbind` service, and whether it should be enabled at system boot.
|
||||
|
||||
## Dependencies
|
||||
|
||||
None.
|
||||
|
||||
## Example Playbook
|
||||
|
||||
- hosts: db-servers
|
||||
roles:
|
||||
- { role: geerlingguy.nfs }
|
||||
|
||||
## License
|
||||
|
||||
MIT / BSD
|
||||
|
||||
## Author Information
|
||||
|
||||
This role was created in 2014 by [Jeff Geerling](https://www.jeffgeerling.com/), author of [Ansible for DevOps](https://www.ansiblefordevops.com/).
|
5
roles/geerlingguy.nfs_server/defaults/main.yml
Normal file
5
roles/geerlingguy.nfs_server/defaults/main.yml
Normal file
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
nfs_exports: []
|
||||
|
||||
nfs_rpcbind_state: started
|
||||
nfs_rpcbind_enabled: true
|
3
roles/geerlingguy.nfs_server/handlers/main.yml
Normal file
3
roles/geerlingguy.nfs_server/handlers/main.yml
Normal file
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
- name: reload nfs
|
||||
command: 'exportfs -ra'
|
30
roles/geerlingguy.nfs_server/meta/main.yml
Normal file
30
roles/geerlingguy.nfs_server/meta/main.yml
Normal file
|
@ -0,0 +1,30 @@
|
|||
---
|
||||
dependencies: []
|
||||
|
||||
galaxy_info:
|
||||
role_name: nfs
|
||||
author: geerlingguy
|
||||
description: NFS installation for Linux.
|
||||
company: "Midwestern Mac, LLC"
|
||||
license: "license (BSD, MIT)"
|
||||
min_ansible_version: 2.4
|
||||
platforms:
|
||||
- name: EL
|
||||
versions:
|
||||
- all
|
||||
- name: Fedora
|
||||
versions:
|
||||
- all
|
||||
- name: Debian
|
||||
versions:
|
||||
- all
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- all
|
||||
galaxy_tags:
|
||||
- system
|
||||
- nfs
|
||||
- filesystem
|
||||
- share
|
||||
- nfsv4
|
||||
- efs
|
13
roles/geerlingguy.nfs_server/molecule/default/converge.yml
Normal file
13
roles/geerlingguy.nfs_server/molecule/default/converge.yml
Normal file
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
- name: Converge
|
||||
hosts: all
|
||||
become: true
|
||||
|
||||
pre_tasks:
|
||||
- name: Update apt cache.
|
||||
apt: update_cache=yes cache_valid_time=600
|
||||
when: ansible_os_family == 'Debian'
|
||||
changed_when: false
|
||||
|
||||
roles:
|
||||
- role: geerlingguy.nfs
|
18
roles/geerlingguy.nfs_server/molecule/default/molecule.yml
Normal file
18
roles/geerlingguy.nfs_server/molecule/default/molecule.yml
Normal file
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
role_name_check: 1
|
||||
dependency:
|
||||
name: galaxy
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: instance
|
||||
image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest"
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
converge: ${MOLECULE_PLAYBOOK:-converge.yml}
|
36
roles/geerlingguy.nfs_server/tasks/main.yml
Normal file
36
roles/geerlingguy.nfs_server/tasks/main.yml
Normal file
|
@ -0,0 +1,36 @@
|
|||
---
|
||||
# Include variables and define needed variables.
|
||||
- name: Include OS-specific variables.
|
||||
include_vars: "{{ ansible_os_family }}.yml"
|
||||
|
||||
- name: Include overrides specific to Fedora.
|
||||
include_vars: Fedora.yml
|
||||
when:
|
||||
- ansible_os_family == 'RedHat'
|
||||
- ansible_distribution == "Fedora"
|
||||
|
||||
# Setup/install tasks.
|
||||
- include_tasks: setup-RedHat.yml
|
||||
when: ansible_os_family == 'RedHat'
|
||||
|
||||
- include_tasks: setup-Debian.yml
|
||||
when: ansible_os_family == 'Debian'
|
||||
|
||||
- name: Ensure directories to export exist
|
||||
file: # noqa 208
|
||||
path: "{{ item.strip().split()[0] }}"
|
||||
state: directory
|
||||
with_items: "{{ nfs_exports }}"
|
||||
|
||||
- name: Copy exports file.
|
||||
template:
|
||||
src: exports.j2
|
||||
dest: /etc/exports
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: reload nfs
|
||||
|
||||
- name: Ensure nfs is running.
|
||||
service: "name={{ nfs_server_daemon }} state=started enabled=yes"
|
||||
when: nfs_exports|length
|
7
roles/geerlingguy.nfs_server/tasks/setup-Debian.yml
Normal file
7
roles/geerlingguy.nfs_server/tasks/setup-Debian.yml
Normal file
|
@ -0,0 +1,7 @@
|
|||
---
|
||||
- name: Ensure NFS utilities are installed.
|
||||
apt:
|
||||
name:
|
||||
- nfs-common
|
||||
- nfs-kernel-server
|
||||
state: present
|
9
roles/geerlingguy.nfs_server/tasks/setup-RedHat.yml
Normal file
9
roles/geerlingguy.nfs_server/tasks/setup-RedHat.yml
Normal file
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
- name: Ensure NFS utilities are installed.
|
||||
package: name=nfs-utils state=present
|
||||
|
||||
- name: Ensure rpcbind is running as configured.
|
||||
service:
|
||||
name: rpcbind
|
||||
state: "{{ nfs_rpcbind_state }}"
|
||||
enabled: "{{ nfs_rpcbind_enabled }}"
|
13
roles/geerlingguy.nfs_server/templates/exports.j2
Normal file
13
roles/geerlingguy.nfs_server/templates/exports.j2
Normal file
|
@ -0,0 +1,13 @@
|
|||
# /etc/exports: the access control list for filesystems which may be exported
|
||||
# to NFS clients. See exports(5).
|
||||
#
|
||||
# Example for NFSv2 and NFSv3:
|
||||
# /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
|
||||
#
|
||||
# Example for NFSv4:
|
||||
# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
|
||||
# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
|
||||
#
|
||||
{% for export in nfs_exports %}
|
||||
{{ export }}
|
||||
{% endfor %}
|
2
roles/geerlingguy.nfs_server/vars/Debian.yml
Normal file
2
roles/geerlingguy.nfs_server/vars/Debian.yml
Normal file
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
nfs_server_daemon: nfs-kernel-server
|
2
roles/geerlingguy.nfs_server/vars/Fedora.yml
Normal file
2
roles/geerlingguy.nfs_server/vars/Fedora.yml
Normal file
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
nfs_server_daemon: nfs-server
|
2
roles/geerlingguy.nfs_server/vars/RedHat.yml
Normal file
2
roles/geerlingguy.nfs_server/vars/RedHat.yml
Normal file
|
@ -0,0 +1,2 @@
|
|||
---
|
||||
nfs_server_daemon: nfs-server
|
674
roles/mgrote.fluxcd/LICENSE
Normal file
674
roles/mgrote.fluxcd/LICENSE
Normal file
|
@ -0,0 +1,674 @@
|
|||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU General Public License is a free, copyleft license for
|
||||
software and other kinds of works.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
the GNU General Public License is intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users. We, the Free Software Foundation, use the
|
||||
GNU General Public License for most of our software; it applies also to
|
||||
any other work released this way by its authors. You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to prevent others from denying you
|
||||
these rights or asking you to surrender the rights. Therefore, you have
|
||||
certain responsibilities if you distribute copies of the software, or if
|
||||
you modify it: responsibilities to respect the freedom of others.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must pass on to the recipients the same
|
||||
freedoms that you received. You must make sure that they, too, receive
|
||||
or can get the source code. And you must show them these terms so they
|
||||
know their rights.
|
||||
|
||||
Developers that use the GNU GPL protect your rights with two steps:
|
||||
(1) assert copyright on the software, and (2) offer you this License
|
||||
giving you legal permission to copy, distribute and/or modify it.
|
||||
|
||||
For the developers' and authors' protection, the GPL clearly explains
|
||||
that there is no warranty for this free software. For both users' and
|
||||
authors' sake, the GPL requires that modified versions be marked as
|
||||
changed, so that their problems will not be attributed erroneously to
|
||||
authors of previous versions.
|
||||
|
||||
Some devices are designed to deny users access to install or run
|
||||
modified versions of the software inside them, although the manufacturer
|
||||
can do so. This is fundamentally incompatible with the aim of
|
||||
protecting users' freedom to change the software. The systematic
|
||||
pattern of such abuse occurs in the area of products for individuals to
|
||||
use, which is precisely where it is most unacceptable. Therefore, we
|
||||
have designed this version of the GPL to prohibit the practice for those
|
||||
products. If such problems arise substantially in other domains, we
|
||||
stand ready to extend this provision to those domains in future versions
|
||||
of the GPL, as needed to protect the freedom of users.
|
||||
|
||||
Finally, every program is threatened constantly by software patents.
|
||||
States should not allow patents to restrict development and use of
|
||||
software on general-purpose computers, but in those that do, we wish to
|
||||
avoid the special danger that patents applied to a free program could
|
||||
make it effectively proprietary. To prevent this, the GPL assures that
|
||||
patents cannot be used to render the program non-free.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Use with the GNU Affero General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU Affero General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the special requirements of the GNU Affero General Public License,
|
||||
section 13, concerning interaction through a network will apply to the
|
||||
combination as such.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program does terminal interaction, make it output a short
|
||||
notice like this when it starts in an interactive mode:
|
||||
|
||||
<program> Copyright (C) <year> <name of author>
|
||||
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, your program's commands
|
||||
might be different; for a GUI interface, you would use an "about box".
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU GPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
|
||||
The GNU General Public License does not permit incorporating your program
|
||||
into proprietary programs. If your program is a subroutine library, you
|
||||
may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
3
roles/mgrote.fluxcd/README.md
Normal file
3
roles/mgrote.fluxcd/README.md
Normal file
|
@ -0,0 +1,3 @@
|
|||
# mgrote.fluxcd
|
||||
|
||||
Diese Rolle installiert Flux innerhalb des Culsters und generiert einen SSH-Key der im Gitea-Repo als Deploytoken MIT Schreibrechten abgelegt werden muss.
|
17
roles/mgrote.fluxcd/defaults/main.yml
Normal file
17
roles/mgrote.fluxcd/defaults/main.yml
Normal file
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
flux_repo_url:
|
||||
flux_repo_host: git.mgrote.net
|
||||
flux_repo_host_port: 2222
|
||||
flux_repo_branch: master
|
||||
flux_repo_url_complete: ssh://gitea@git.mgrote.net:2222/mg/k3s-fluxcd.git
|
||||
flux_install_host: k3s1.grote.lan
|
||||
flux_homedir: /home/flux
|
||||
flux_path_ssh_dir: /home/flux/.ssh
|
||||
flux_user_group: flux
|
||||
flux_user: flux
|
||||
flux_download_url: https://github.com/fluxcd/flux2/releases/download/v0.35.0/flux_0.35.0_linux_amd64.tar.gz
|
||||
flux_path_bin: /usr/local/sbin
|
||||
flux_path_ssh_id_file: id_rsa
|
||||
flux_ssh_key_format: ed25519
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
flux_sync_interval: 1m
|
97
roles/mgrote.fluxcd/tasks/main.yml
Normal file
97
roles/mgrote.fluxcd/tasks/main.yml
Normal file
|
@ -0,0 +1,97 @@
|
|||
---
|
||||
- name: include user tasks
|
||||
include_tasks: user.yml
|
||||
|
||||
- name: check if flux is installed
|
||||
command: which flux
|
||||
changed_when: false
|
||||
failed_when: flux_installed.rc not in [0,1]
|
||||
register: flux_installed
|
||||
|
||||
- name: download flux binary
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ flux_download_url }}"
|
||||
dest: "{{ flux_path_bin }}"
|
||||
mode: 0755
|
||||
owner: "{{ flux_user }}"
|
||||
group: "{{ flux_user_group }}"
|
||||
remote_src: yes
|
||||
creates: "{{ flux_path_bin }}/flux"
|
||||
when: flux_installed.rc not in [ 0 ]
|
||||
|
||||
- name: install bash-completion packages
|
||||
become: yes
|
||||
ansible.builtin.package:
|
||||
name: bash-completion
|
||||
state: present
|
||||
|
||||
- name: activate autocompletion for flux
|
||||
become: yes
|
||||
ansible.builtin.shell:
|
||||
cmd: "flux completion bash | sudo tee /etc/bash_completion.d/flux"
|
||||
args:
|
||||
creates: /etc/bash_completion.d/flux
|
||||
|
||||
- name: install flux
|
||||
block:
|
||||
- name: ensure .ssh directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ flux_path_ssh_dir }}"
|
||||
owner: "{{ flux_user }}"
|
||||
group: "{{ flux_user_group }}"
|
||||
state: directory
|
||||
|
||||
- name: check if OpenSSH keypair exists
|
||||
stat:
|
||||
path: "{{ flux_path_ssh_dir }}/{{ flux_path_ssh_id_file }}"
|
||||
register: ssh_exist
|
||||
|
||||
- name: generate SSH keypair
|
||||
community.crypto.openssh_keypair:
|
||||
path: "{{ flux_path_ssh_dir }}/{{ flux_path_ssh_id_file }}"
|
||||
owner: "{{ flux_user }}"
|
||||
group: "{{ flux_user_group }}"
|
||||
type: "{{ flux_ssh_key_format }}"
|
||||
when: ssh_exist.stat.exists == False
|
||||
register: create_ssh_key
|
||||
|
||||
- name: get publickey
|
||||
ansible.builtin.command: cat "{{ flux_path_ssh_dir }}/{{ flux_path_ssh_id_file }}.pub"
|
||||
when: create_ssh_key.changed
|
||||
register: ssh_public_key
|
||||
|
||||
- name: show publickey
|
||||
debug:
|
||||
msg: "{{ ssh_public_key.stdout }}"
|
||||
when: create_ssh_key.changed
|
||||
|
||||
- name: copy publickey to gitea as deploy-key WITH write-permissions!
|
||||
ansible.builtin.pause:
|
||||
prompt: "Make sure the key is saved!"
|
||||
when: create_ssh_key.changed
|
||||
|
||||
- name: set permissions for $kubeconfig
|
||||
ansible.builtin.file:
|
||||
path: "{{ kubeconfig }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: template bootstrap script
|
||||
ansible.builtin.template:
|
||||
src: bootstrap.sh
|
||||
dest: "{{ flux_homedir }}/bootstrap.sh"
|
||||
mode: 0544
|
||||
owner: "{{ flux_user }}"
|
||||
group: "{{ flux_user_group }}"
|
||||
register: bootstrap
|
||||
|
||||
- name: flux install
|
||||
ansible.builtin.shell: "{{ flux_homedir }}/bootstrap.sh"
|
||||
become_user: "{{ flux_user }}"
|
||||
when: bootstrap.changed
|
||||
# der ganze block nur auf enem host
|
||||
run_once: true
|
||||
when: ansible_host == flux_install_host
|
||||
|
||||
# podeinfo: http://k3s1.grote.lan:30778
|
18
roles/mgrote.fluxcd/tasks/user.yml
Normal file
18
roles/mgrote.fluxcd/tasks/user.yml
Normal file
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
- name: ensure group exists
|
||||
become: true
|
||||
ansible.builtin.group:
|
||||
name: "{{ flux_user_group }}"
|
||||
state: present
|
||||
when:
|
||||
- flux_user_group is defined
|
||||
|
||||
- name: ensure user exists
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ flux_user }}"
|
||||
group: "{{ flux_user_group }}"
|
||||
create_home: no
|
||||
when:
|
||||
- flux_user_group is defined
|
||||
- flux_user is defined
|
4
roles/mgrote.fluxcd/templates/bootstrap.sh
Normal file
4
roles/mgrote.fluxcd/templates/bootstrap.sh
Normal file
|
@ -0,0 +1,4 @@
|
|||
#!/bin/bash
|
||||
ssh-keyscan -p {{ flux_repo_host_port }} {{ flux_repo_host }} > {{ flux_path_ssh_dir }}/known_hosts
|
||||
|
||||
flux bootstrap git --url={{ flux_repo_url_complete }} --interval={{ flux_sync_interval }} --branch={{ flux_repo_branch }} --path=cluster --kubeconfig {{ kubeconfig }} --private-key-file {{ flux_path_ssh_dir }}/{{ flux_path_ssh_id_file }} --silent
|
674
roles/mgrote.k8s_autocompletion/LICENSE
Normal file
674
roles/mgrote.k8s_autocompletion/LICENSE
Normal file
|
@ -0,0 +1,674 @@
|
|||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU General Public License is a free, copyleft license for
|
||||
software and other kinds of works.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
the GNU General Public License is intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users. We, the Free Software Foundation, use the
|
||||
GNU General Public License for most of our software; it applies also to
|
||||
any other work released this way by its authors. You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to prevent others from denying you
|
||||
these rights or asking you to surrender the rights. Therefore, you have
|
||||
certain responsibilities if you distribute copies of the software, or if
|
||||
you modify it: responsibilities to respect the freedom of others.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must pass on to the recipients the same
|
||||
freedoms that you received. You must make sure that they, too, receive
|
||||
or can get the source code. And you must show them these terms so they
|
||||
know their rights.
|
||||
|
||||
Developers that use the GNU GPL protect your rights with two steps:
|
||||
(1) assert copyright on the software, and (2) offer you this License
|
||||
giving you legal permission to copy, distribute and/or modify it.
|
||||
|
||||
For the developers' and authors' protection, the GPL clearly explains
|
||||
that there is no warranty for this free software. For both users' and
|
||||
authors' sake, the GPL requires that modified versions be marked as
|
||||
changed, so that their problems will not be attributed erroneously to
|
||||
authors of previous versions.
|
||||
|
||||
Some devices are designed to deny users access to install or run
|
||||
modified versions of the software inside them, although the manufacturer
|
||||
can do so. This is fundamentally incompatible with the aim of
|
||||
protecting users' freedom to change the software. The systematic
|
||||
pattern of such abuse occurs in the area of products for individuals to
|
||||
use, which is precisely where it is most unacceptable. Therefore, we
|
||||
have designed this version of the GPL to prohibit the practice for those
|
||||
products. If such problems arise substantially in other domains, we
|
||||
stand ready to extend this provision to those domains in future versions
|
||||
of the GPL, as needed to protect the freedom of users.
|
||||
|
||||
Finally, every program is threatened constantly by software patents.
|
||||
States should not allow patents to restrict development and use of
|
||||
software on general-purpose computers, but in those that do, we wish to
|
||||
avoid the special danger that patents applied to a free program could
|
||||
make it effectively proprietary. To prevent this, the GPL assures that
|
||||
patents cannot be used to render the program non-free.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Use with the GNU Affero General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU Affero General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the special requirements of the GNU Affero General Public License,
|
||||
section 13, concerning interaction through a network will apply to the
|
||||
combination as such.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program does terminal interaction, make it output a short
|
||||
notice like this when it starts in an interactive mode:
|
||||
|
||||
<program> Copyright (C) <year> <name of author>
|
||||
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, your program's commands
|
||||
might be different; for a GUI interface, you would use an "about box".
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU GPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
|
||||
The GNU General Public License does not permit incorporating your program
|
||||
into proprietary programs. If your program is a subroutine library, you
|
||||
may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
5
roles/mgrote.k8s_autocompletion/README.md
Normal file
5
roles/mgrote.k8s_autocompletion/README.md
Normal file
|
@ -0,0 +1,5 @@
|
|||
## mgrote.kubectl_autocompletion
|
||||
|
||||
### Beschreibung
|
||||
|
||||
Aktiviere kubectl autocompletion: https://kubernetes.io/docs/tasks/tools/included/optional-kubectl-configs-bash-linux/
|
13
roles/mgrote.k8s_autocompletion/tasks/main.yml
Normal file
13
roles/mgrote.k8s_autocompletion/tasks/main.yml
Normal file
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
- name: install bash-completion packages
|
||||
become: yes
|
||||
ansible.builtin.package:
|
||||
name: bash-completion
|
||||
state: present
|
||||
|
||||
- name: activate autocompletion for kubectl
|
||||
become: yes
|
||||
ansible.builtin.shell:
|
||||
cmd: "kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl"
|
||||
args:
|
||||
creates: /etc/bash_completion.d/kubectl
|
674
roles/mgrote.k8s_misc/LICENSE
Normal file
674
roles/mgrote.k8s_misc/LICENSE
Normal file
|
@ -0,0 +1,674 @@
|
|||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU General Public License is a free, copyleft license for
|
||||
software and other kinds of works.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
the GNU General Public License is intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users. We, the Free Software Foundation, use the
|
||||
GNU General Public License for most of our software; it applies also to
|
||||
any other work released this way by its authors. You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to prevent others from denying you
|
||||
these rights or asking you to surrender the rights. Therefore, you have
|
||||
certain responsibilities if you distribute copies of the software, or if
|
||||
you modify it: responsibilities to respect the freedom of others.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must pass on to the recipients the same
|
||||
freedoms that you received. You must make sure that they, too, receive
|
||||
or can get the source code. And you must show them these terms so they
|
||||
know their rights.
|
||||
|
||||
Developers that use the GNU GPL protect your rights with two steps:
|
||||
(1) assert copyright on the software, and (2) offer you this License
|
||||
giving you legal permission to copy, distribute and/or modify it.
|
||||
|
||||
For the developers' and authors' protection, the GPL clearly explains
|
||||
that there is no warranty for this free software. For both users' and
|
||||
authors' sake, the GPL requires that modified versions be marked as
|
||||
changed, so that their problems will not be attributed erroneously to
|
||||
authors of previous versions.
|
||||
|
||||
Some devices are designed to deny users access to install or run
|
||||
modified versions of the software inside them, although the manufacturer
|
||||
can do so. This is fundamentally incompatible with the aim of
|
||||
protecting users' freedom to change the software. The systematic
|
||||
pattern of such abuse occurs in the area of products for individuals to
|
||||
use, which is precisely where it is most unacceptable. Therefore, we
|
||||
have designed this version of the GPL to prohibit the practice for those
|
||||
products. If such problems arise substantially in other domains, we
|
||||
stand ready to extend this provision to those domains in future versions
|
||||
of the GPL, as needed to protect the freedom of users.
|
||||
|
||||
Finally, every program is threatened constantly by software patents.
|
||||
States should not allow patents to restrict development and use of
|
||||
software on general-purpose computers, but in those that do, we wish to
|
||||
avoid the special danger that patents applied to a free program could
|
||||
make it effectively proprietary. To prevent this, the GPL assures that
|
||||
patents cannot be used to render the program non-free.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Use with the GNU Affero General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU Affero General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the special requirements of the GNU Affero General Public License,
|
||||
section 13, concerning interaction through a network will apply to the
|
||||
combination as such.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program does terminal interaction, make it output a short
|
||||
notice like this when it starts in an interactive mode:
|
||||
|
||||
<program> Copyright (C) <year> <name of author>
|
||||
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, your program's commands
|
||||
might be different; for a GUI interface, you would use an "about box".
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU GPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
|
||||
The GNU General Public License does not permit incorporating your program
|
||||
into proprietary programs. If your program is a subroutine library, you
|
||||
may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
3
roles/mgrote.k8s_misc/README.md
Normal file
3
roles/mgrote.k8s_misc/README.md
Normal file
|
@ -0,0 +1,3 @@
|
|||
# mgrote.k8s_misc
|
||||
|
||||
Diese Rolle hinterlegt die Kubeconfig-Variable in der `.bashrc` von `root`.
|
7
roles/mgrote.k8s_misc/tasks/main.yml
Normal file
7
roles/mgrote.k8s_misc/tasks/main.yml
Normal file
|
@ -0,0 +1,7 @@
|
|||
---
|
||||
- name: set $KUBECONFIG for root
|
||||
ansible.builtin.blockinfile:
|
||||
path: /root/.bashrc
|
||||
block: |
|
||||
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK - K3S"
|
674
roles/mgrote.sealed-secrets/LICENSE
Normal file
674
roles/mgrote.sealed-secrets/LICENSE
Normal file
|
@ -0,0 +1,674 @@
|
|||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU General Public License is a free, copyleft license for
|
||||
software and other kinds of works.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
the GNU General Public License is intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users. We, the Free Software Foundation, use the
|
||||
GNU General Public License for most of our software; it applies also to
|
||||
any other work released this way by its authors. You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to prevent others from denying you
|
||||
these rights or asking you to surrender the rights. Therefore, you have
|
||||
certain responsibilities if you distribute copies of the software, or if
|
||||
you modify it: responsibilities to respect the freedom of others.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must pass on to the recipients the same
|
||||
freedoms that you received. You must make sure that they, too, receive
|
||||
or can get the source code. And you must show them these terms so they
|
||||
know their rights.
|
||||
|
||||
Developers that use the GNU GPL protect your rights with two steps:
|
||||
(1) assert copyright on the software, and (2) offer you this License
|
||||
giving you legal permission to copy, distribute and/or modify it.
|
||||
|
||||
For the developers' and authors' protection, the GPL clearly explains
|
||||
that there is no warranty for this free software. For both users' and
|
||||
authors' sake, the GPL requires that modified versions be marked as
|
||||
changed, so that their problems will not be attributed erroneously to
|
||||
authors of previous versions.
|
||||
|
||||
Some devices are designed to deny users access to install or run
|
||||
modified versions of the software inside them, although the manufacturer
|
||||
can do so. This is fundamentally incompatible with the aim of
|
||||
protecting users' freedom to change the software. The systematic
|
||||
pattern of such abuse occurs in the area of products for individuals to
|
||||
use, which is precisely where it is most unacceptable. Therefore, we
|
||||
have designed this version of the GPL to prohibit the practice for those
|
||||
products. If such problems arise substantially in other domains, we
|
||||
stand ready to extend this provision to those domains in future versions
|
||||
of the GPL, as needed to protect the freedom of users.
|
||||
|
||||
Finally, every program is threatened constantly by software patents.
|
||||
States should not allow patents to restrict development and use of
|
||||
software on general-purpose computers, but in those that do, we wish to
|
||||
avoid the special danger that patents applied to a free program could
|
||||
make it effectively proprietary. To prevent this, the GPL assures that
|
||||
patents cannot be used to render the program non-free.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Use with the GNU Affero General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU Affero General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the special requirements of the GNU Affero General Public License,
|
||||
section 13, concerning interaction through a network will apply to the
|
||||
combination as such.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program does terminal interaction, make it output a short
|
||||
notice like this when it starts in an interactive mode:
|
||||
|
||||
<program> Copyright (C) <year> <name of author>
|
||||
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, your program's commands
|
||||
might be different; for a GUI interface, you would use an "about box".
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU GPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
|
||||
The GNU General Public License does not permit incorporating your program
|
||||
into proprietary programs. If your program is a subroutine library, you
|
||||
may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
49
roles/mgrote.sealed-secrets/README.md
Normal file
49
roles/mgrote.sealed-secrets/README.md
Normal file
|
@ -0,0 +1,49 @@
|
|||
# mgrote.sealed-secrets
|
||||
|
||||
Diese Rolle installiert das kubeseal-Binary und hinterlegt den Private-Key im Cluster.
|
||||
|
||||
Der Key ist im Keepass im Eintrag unter "Notes" abgelegt. Sollten die Secrets neu verschlüsselt werden ist hier wieder der aktuelle Private-Key abzulegen.
|
||||
|
||||
Siehe: https://github.com/bitnami-labs/sealed-secrets#how-can-i-do-a-backup-of-my-sealedsecrets
|
||||
|
||||
## Backup
|
||||
|
||||
`kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o yaml >main.key`
|
||||
|
||||
## Restore
|
||||
|
||||
```
|
||||
kubectl apply -f main.key
|
||||
kubectl delete pod -n kube-system -l name=sealed-secrets-controller
|
||||
```
|
||||
|
||||
|
||||
## Erstellen eines verschlüsselten Secrets
|
||||
|
||||
- Wichtig ist "stringData", wird nur "data" verwendet ist der Inhalt base64 zu enkodieren.
|
||||
|
||||
1. lege Secret mit Klartext VALUE als Datei() an
|
||||
```
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: NAME_DES_SECRETS
|
||||
namespace: drone
|
||||
stringData:
|
||||
ICH_BIN_DER VARIABLEN_NAME: ICH_BIN_DAS_PASSWORT
|
||||
```
|
||||
2. diese Datei mit kubeseal verschlüsseln
|
||||
```
|
||||
cat <datei> | kubeseal --format=yaml
|
||||
```
|
||||
3. den Inhalt dann als Secret im Repo ablegen ablegen
|
||||
|
||||
## Verwenden des Secrets
|
||||
|
||||
```
|
||||
- name: DRONE_RPC_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: NAME_DES_SECRETS
|
||||
key: ICH_BIN_DER VARIABLEN_NAME
|
||||
```
|
8
roles/mgrote.sealed-secrets/defaults/main.yml
Normal file
8
roles/mgrote.sealed-secrets/defaults/main.yml
Normal file
|
@ -0,0 +1,8 @@
|
|||
---
|
||||
sealed_secrets_homedir: /home/sealed_secrets
|
||||
sealed_secrets_user_group: sealed_secrets
|
||||
sealed_secrets_user: sealed_secrets
|
||||
kubeseal_download_url: "https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.19.1/kubeseal-0.19.1-linux-amd64.tar.gz"
|
||||
kubeseal_path_bin: /usr/local/sbin
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
sealed_secrets_keepass_entry_name: "{{ lookup('keepass', 'k3s-sealed-secrets-private-key', 'notes') }}"
|
29
roles/mgrote.sealed-secrets/tasks/import.yml
Normal file
29
roles/mgrote.sealed-secrets/tasks/import.yml
Normal file
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
- name: check if private key exists
|
||||
ansible.builtin.command: kubectl get secrets sealed-secrets-key9mpfq -n kube-system
|
||||
register: key
|
||||
ignore_errors: yes
|
||||
changed_when: false
|
||||
|
||||
- name: Template private key file
|
||||
ansible.builtin.template:
|
||||
src: private.key.j2
|
||||
dest: /root/private.key
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0400'
|
||||
when: key.rc not in [ 0 ]
|
||||
no_log: True
|
||||
|
||||
- name: apply private key
|
||||
ansible.builtin.command: kubectl apply -f /root/private.key
|
||||
when: key.rc not in [ 0 ]
|
||||
|
||||
- name: remove old pod
|
||||
ansible.builtin.command: kubectl delete pod -n kube-system -l name=sealed-secrets-controller
|
||||
when: key.rc not in [ 0 ]
|
||||
|
||||
- name: remove private key file
|
||||
ansible.builtin.file:
|
||||
path: /root/private.key
|
||||
state: absent
|
26
roles/mgrote.sealed-secrets/tasks/main.yml
Normal file
26
roles/mgrote.sealed-secrets/tasks/main.yml
Normal file
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
- name: include user tasks
|
||||
include_tasks: user.yml
|
||||
|
||||
- name: check if kubeseal is installed
|
||||
command: which kubeseal
|
||||
changed_when: false
|
||||
failed_when: kubeseal_installed.rc not in [0,1]
|
||||
register: kubeseal_installed
|
||||
|
||||
- name: download sealed_secrets binary
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ kubeseal_download_url }}"
|
||||
dest: "{{ kubeseal_path_bin }}"
|
||||
mode: 0755
|
||||
owner: "{{ sealed_secrets_user }}"
|
||||
group: "{{ sealed_secrets_user_group }}"
|
||||
remote_src: yes
|
||||
creates: "{{ kubeseal_path_bin }}/kubeseal"
|
||||
when: kubeseal_installed.rc not in [ 0 ]
|
||||
|
||||
- name: include import tasks
|
||||
include_tasks: import.yml
|
||||
# der ganze block nur auf enem host
|
||||
run_once: true
|
||||
when: ansible_host == flux_install_host
|
18
roles/mgrote.sealed-secrets/tasks/user.yml
Normal file
18
roles/mgrote.sealed-secrets/tasks/user.yml
Normal file
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
- name: ensure group exists
|
||||
become: true
|
||||
ansible.builtin.group:
|
||||
name: "{{ sealed_secrets_user_group }}"
|
||||
state: present
|
||||
when:
|
||||
- sealed_secrets_user_group is defined
|
||||
|
||||
- name: ensure user exists
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ sealed_secrets_user }}"
|
||||
group: "{{ sealed_secrets_user_group }}"
|
||||
create_home: no
|
||||
when:
|
||||
- sealed_secrets_user_group is defined
|
||||
- sealed_secrets_user is defined
|
1
roles/mgrote.sealed-secrets/templates/private.key.j2
Normal file
1
roles/mgrote.sealed-secrets/templates/private.key.j2
Normal file
|
@ -0,0 +1 @@
|
|||
{{ sealed_secrets_keepass_entry_name }}
|
4
roles/pandemonium1986.ansible-role-k9s/defaults/main.yml
Normal file
4
roles/pandemonium1986.ansible-role-k9s/defaults/main.yml
Normal file
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
k9s_cache_path: "/var/cache/github"
|
||||
k9s_installation_path: "/opt/github/k9s"
|
||||
k9s_version: "v0.24.15"
|
28
roles/pandemonium1986.ansible-role-k9s/tasks/main.yml
Normal file
28
roles/pandemonium1986.ansible-role-k9s/tasks/main.yml
Normal file
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
- name: Ensure k9s directories are created
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0755"
|
||||
loop:
|
||||
- "{{ k9s_cache_path }}"
|
||||
- "{{ k9s_installation_path }}"
|
||||
|
||||
- name: Ensure k9s is installed
|
||||
get_url:
|
||||
url: "{{ source_url }}/{{ github_namespace }}/releases/download/{{ k9s_version }}/{{ asset_name }}"
|
||||
dest: "{{ k9s_cache_path }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Unarchive k9s archive into k9s_installation_path
|
||||
unarchive:
|
||||
src: "{{ k9s_cache_path }}/{{ asset_name }}"
|
||||
dest: "{{ k9s_installation_path }}"
|
||||
remote_src: true
|
||||
mode: "0755"
|
||||
|
||||
- name: Ensure k9s link is created
|
||||
file:
|
||||
src: "{{ k9s_installation_path }}/{{ binary_name }}"
|
||||
dest: "/usr/local/bin/{{ binary_name }}"
|
||||
state: link
|
5
roles/pandemonium1986.ansible-role-k9s/vars/main.yml
Normal file
5
roles/pandemonium1986.ansible-role-k9s/vars/main.yml
Normal file
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
source_url: "https://github.com"
|
||||
github_namespace: "derailed/k9s"
|
||||
asset_name: "k9s_Linux_x86_64.tar.gz"
|
||||
binary_name: "k9s"
|
4
roles/xanmanning.k3s/.ansible-lint
Normal file
4
roles/xanmanning.k3s/.ansible-lint
Normal file
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
|
||||
skip_list:
|
||||
- role-name
|
26
roles/xanmanning.k3s/.devcontainer/Dockerfile
Normal file
26
roles/xanmanning.k3s/.devcontainer/Dockerfile
Normal file
|
@ -0,0 +1,26 @@
|
|||
ARG VARIANT=focal
|
||||
FROM ubuntu:${VARIANT}
|
||||
|
||||
COPY molecule/requirements.txt /tmp/molecule/requirements.txt
|
||||
COPY requirements.txt /tmp/requirements.txt
|
||||
|
||||
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
|
||||
&& apt-get -y install curl git python3-dev python3-pip \
|
||||
python3-venv shellcheck sudo unzip docker.io jq \
|
||||
&& curl -L \
|
||||
"https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
||||
-o /usr/bin/kubectl \
|
||||
&& chmod +x /usr/bin/kubectl \
|
||||
&& python3 -m pip install pip --upgrade \
|
||||
&& python3 -m pip install -r /tmp/molecule/requirements.txt
|
||||
|
||||
RUN useradd -s /bin/bash -m vscode && \
|
||||
usermod -aG docker vscode && \
|
||||
echo 'vscode ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/vscode && \
|
||||
echo 'source /etc/bash_completion.d/git-prompt' >> /home/vscode/.bashrc && \
|
||||
echo 'sudo chown vscode /var/run/docker-host.sock' >> /home/vscode/.bashrc && \
|
||||
echo 'export PS1="${PS1:0:-1}\[\033[38;5;196m\]$(__git_ps1)\[$(tput sgr0)\] "' >> /home/vscode/.bashrc
|
||||
|
||||
RUN ln -s /var/run/docker-host.sock /var/run/docker.sock
|
||||
|
||||
USER vscode
|
28
roles/xanmanning.k3s/.devcontainer/devcontainer.json
Normal file
28
roles/xanmanning.k3s/.devcontainer/devcontainer.json
Normal file
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"name": "Ubuntu",
|
||||
"build": {
|
||||
"context": "..",
|
||||
"dockerfile": "Dockerfile",
|
||||
"args": { "VARIANT": "focal" }
|
||||
},
|
||||
|
||||
"settings": {
|
||||
"terminal.integrated.profiles.linux": {
|
||||
"bash (login)": {
|
||||
"path": "/bin/bash",
|
||||
"args": ["-l"]
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
"extensions": [
|
||||
"ms-azuretools.vscode-docker",
|
||||
"redhat.vscode-yaml"
|
||||
],
|
||||
|
||||
"mounts": [
|
||||
"source=/var/run/docker.sock,target=/var/run/docker-host.sock,type=bind"
|
||||
],
|
||||
|
||||
"remoteUser": "vscode"
|
||||
}
|
55
roles/xanmanning.k3s/.github/ISSUE_TEMPLATE/bug_report.md
vendored
Normal file
55
roles/xanmanning.k3s/.github/ISSUE_TEMPLATE/bug_report.md
vendored
Normal file
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
---
|
||||
|
||||
<!-- Please first verify that your issue is not already reported on GitHub -->
|
||||
<!-- Complete *all* sections as described. -->
|
||||
|
||||
### Summary
|
||||
|
||||
<!-- Explain the problem briefly below -->
|
||||
|
||||
### Issue Type
|
||||
|
||||
- Bug Report
|
||||
|
||||
### Controller Environment and Configuration
|
||||
|
||||
<!-- Please re-run your playbook with: `-e "pyratlabs_issue_controller_dump=true"` -->
|
||||
<!-- Example: `ansible-playbook -e "pyratlabs_issue_controller_dump=true" /path/to/playbook.yml` -->
|
||||
<!-- Then please copy-and-paste the contents (or attach) to this issue. -->
|
||||
|
||||
<!-- Please also include information about the version of the role you are using -->
|
||||
|
||||
```text
|
||||
|
||||
```
|
||||
|
||||
### Steps to Reproduce
|
||||
|
||||
<!-- Describe exactly how to reproduce the problem, using a minimal test-case -->
|
||||
|
||||
<!-- Paste example playbooks or commands between quotes below -->
|
||||
|
||||
```yaml
|
||||
|
||||
```
|
||||
|
||||
### Expected Result
|
||||
|
||||
<!-- Describe what you expected to happen when running the steps above -->
|
||||
|
||||
```text
|
||||
|
||||
```
|
||||
|
||||
### Actual Result
|
||||
|
||||
<!-- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->
|
||||
|
||||
<!-- Paste verbatim command output between quotes -->
|
||||
|
||||
```text
|
||||
|
||||
```
|
3
roles/xanmanning.k3s/.github/ISSUE_TEMPLATE/config.yml
vendored
Normal file
3
roles/xanmanning.k3s/.github/ISSUE_TEMPLATE/config.yml
vendored
Normal file
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
|
||||
blank_issues_enabled: true
|
33
roles/xanmanning.k3s/.github/ISSUE_TEMPLATE/feature_request.md
vendored
Normal file
33
roles/xanmanning.k3s/.github/ISSUE_TEMPLATE/feature_request.md
vendored
Normal file
|
@ -0,0 +1,33 @@
|
|||
---
|
||||
name: Feature request
|
||||
about: Suggest an idea for this project
|
||||
---
|
||||
|
||||
<!-- Please first verify that your feature was not already discussed on GitHub -->
|
||||
<!-- Complete *all* sections as described, this form is processed automatically -->
|
||||
|
||||
### Summary
|
||||
|
||||
<!-- Describe the new feature/improvement briefly below -->
|
||||
|
||||
### Issue Type
|
||||
|
||||
- Feature Request
|
||||
|
||||
### User Story
|
||||
|
||||
<!-- If you can, please provide a user story, if you don't know what this is don't worry, it will be refined by PyratLabs. -->
|
||||
<!-- Describe who would use it, why it is needed and the benefit -->
|
||||
|
||||
_As a_ <!-- (Insert Persona) --> \
|
||||
_I want to_ <!-- (Insert Action) --> \
|
||||
_So that_ <!-- (Insert Benefit) -->
|
||||
|
||||
### Additional Information
|
||||
|
||||
<!-- Please include any relevant documentation, URLs, etc. -->
|
||||
<!-- Paste example playbooks or commands between quotes below -->
|
||||
|
||||
```yaml
|
||||
|
||||
```
|
37
roles/xanmanning.k3s/.github/PULL_REQUEST_TEMPLATE.md
vendored
Normal file
37
roles/xanmanning.k3s/.github/PULL_REQUEST_TEMPLATE.md
vendored
Normal file
|
@ -0,0 +1,37 @@
|
|||
## TITLE
|
||||
|
||||
### Summary
|
||||
|
||||
<!-- Describe the change below, including rationale and design decisions -->
|
||||
|
||||
<!-- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
|
||||
|
||||
### Issue type
|
||||
|
||||
<!-- Pick one below and delete the rest -->
|
||||
- Bugfix
|
||||
- Documentation
|
||||
- Feature
|
||||
|
||||
### Test instructions
|
||||
|
||||
<!-- Please provide instructions for testing this PR -->
|
||||
|
||||
### Acceptance Criteria
|
||||
|
||||
<!-- Please list criteria required to ensure this change has been sufficiently reviewed. -->
|
||||
|
||||
<!-- Example ticklist:
|
||||
- [ ] GitHub Actions Build passes.
|
||||
- [ ] Documentation updated.
|
||||
-->
|
||||
|
||||
### Additional Information
|
||||
|
||||
<!-- Include additional information to help people understand the change here -->
|
||||
|
||||
<!-- Paste verbatim command output below, e.g. before and after your change -->
|
||||
|
||||
```text
|
||||
|
||||
```
|
18
roles/xanmanning.k3s/.github/stale.yml
vendored
Normal file
18
roles/xanmanning.k3s/.github/stale.yml
vendored
Normal file
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
# Number of days of inactivity before an issue becomes stale
|
||||
daysUntilStale: 60
|
||||
# Number of days of inactivity before a stale issue is closed
|
||||
daysUntilClose: 7
|
||||
# Issues with these labels will never be considered stale
|
||||
exemptLabels:
|
||||
- pinned
|
||||
- security
|
||||
# Label to use when marking an issue as stale
|
||||
staleLabel: wontfix
|
||||
# Comment to post when marking an issue as stale. Set to `false` to disable
|
||||
markComment: >
|
||||
This issue has been automatically marked as stale because it has not had
|
||||
recent activity. It will be closed if no further activity occurs. Thank you
|
||||
for your contributions.
|
||||
# Comment to post when closing a stale issue. Set to `false` to disable
|
||||
closeComment: false
|
75
roles/xanmanning.k3s/.github/workflows/ci.yml
vendored
Normal file
75
roles/xanmanning.k3s/.github/workflows/ci.yml
vendored
Normal file
|
@ -0,0 +1,75 @@
|
|||
---
|
||||
|
||||
name: CI
|
||||
'on':
|
||||
pull_request:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
- main
|
||||
- v1_release
|
||||
schedule:
|
||||
- cron: "0 1 1 * *"
|
||||
|
||||
defaults:
|
||||
run:
|
||||
working-directory: "xanmanning.k3s"
|
||||
|
||||
jobs:
|
||||
molecule:
|
||||
name: Molecule
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- distro: geerlingguy/docker-debian11-ansible:latest
|
||||
scenario: default
|
||||
prebuilt: 'true'
|
||||
- distro: geerlingguy/docker-ubuntu2204-ansible:latest
|
||||
scenario: default
|
||||
prebuilt: 'true'
|
||||
- distro: geerlingguy/docker-amazonlinux2-ansible:latest
|
||||
scenario: default
|
||||
prebuilt: 'true'
|
||||
- distro: geerlingguy/docker-ubuntu2004-ansible:latest
|
||||
scenario: default
|
||||
prebuilt: 'true'
|
||||
- distro: geerlingguy/docker-fedora35-ansible:latest
|
||||
scenario: nodeploy
|
||||
prebuilt: 'true'
|
||||
- distro: geerlingguy/docker-fedora34-ansible:latest
|
||||
scenario: highavailabilitydb
|
||||
prebuilt: 'true'
|
||||
- distro: geerlingguy/docker-fedora33-ansible:latest
|
||||
scenario: autodeploy
|
||||
- distro: xanmanning/docker-alpine-ansible:3.16
|
||||
scenario: highavailabilityetcd
|
||||
prebuilt: 'false'
|
||||
- distro: geerlingguy/docker-rockylinux8-ansible:latest
|
||||
scenario: highavailabilityetcd
|
||||
prebuilt: 'true'
|
||||
|
||||
steps:
|
||||
- name: Checkout codebase
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: "xanmanning.k3s"
|
||||
|
||||
- name: Set up Python 3
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
|
||||
- name: Install test dependencies
|
||||
run: pip3 install -r molecule/requirements.txt
|
||||
|
||||
- name: Run Molecule tests
|
||||
run: molecule test --scenario-name "${{ matrix.scenario }}"
|
||||
# continue-on-error: true
|
||||
env:
|
||||
PY_COLORS: '1'
|
||||
ANSIBLE_FORCE_COLOR: '1'
|
||||
MOLECULE_DISTRO: ${{ matrix.distro }}
|
||||
MOLECULE_PREBUILT: ${{ matrix.prebuilt }}
|
||||
MOLECULE_DOCKER_COMMAND: ${{ matrix.command }}
|
32
roles/xanmanning.k3s/.github/workflows/release.yml
vendored
Normal file
32
roles/xanmanning.k3s/.github/workflows/release.yml
vendored
Normal file
|
@ -0,0 +1,32 @@
|
|||
---
|
||||
|
||||
name: Release
|
||||
'on':
|
||||
push:
|
||||
tags:
|
||||
- '*'
|
||||
|
||||
defaults:
|
||||
run:
|
||||
working-directory: "xanmanning.k3s"
|
||||
|
||||
jobs:
|
||||
release:
|
||||
name: Release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout codebase
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: "xanmanning.k3s"
|
||||
|
||||
- name: Set up Python 3
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
|
||||
- name: Install Ansible
|
||||
run: pip3 install -r requirements.txt
|
||||
|
||||
- name: Trigger a new import on Galaxy
|
||||
run: ansible-galaxy role import --api-key ${{ secrets.GALAXY_API_KEY }} $(echo ${{ github.repository }} | cut -d/ -f1) $(echo ${{ github.repository }} | cut -d/ -f2)
|
13
roles/xanmanning.k3s/.gitignore
vendored
Normal file
13
roles/xanmanning.k3s/.gitignore
vendored
Normal file
|
@ -0,0 +1,13 @@
|
|||
.vagrant
|
||||
*.retry
|
||||
VAULT_PASSWORD
|
||||
VAULT_PASS
|
||||
.vault_pass
|
||||
.vault_pass.asc
|
||||
vagramt/fetch
|
||||
vagrant/ubuntu-*.log
|
||||
__pycache__
|
||||
ansible.cfg
|
||||
pyratlabs-issue-dump.txt
|
||||
.cache
|
||||
/.idea/
|
33
roles/xanmanning.k3s/.yamllint
Normal file
33
roles/xanmanning.k3s/.yamllint
Normal file
|
@ -0,0 +1,33 @@
|
|||
---
|
||||
# Based on ansible-lint config
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
braces:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
brackets:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
colons:
|
||||
max-spaces-after: -1
|
||||
level: error
|
||||
commas:
|
||||
max-spaces-after: -1
|
||||
level: error
|
||||
comments: disable
|
||||
comments-indentation: disable
|
||||
document-start: disable
|
||||
empty-lines:
|
||||
max: 3
|
||||
level: error
|
||||
hyphens:
|
||||
level: error
|
||||
indentation: disable
|
||||
key-duplicates: enable
|
||||
line-length: disable
|
||||
new-line-at-end-of-file: disable
|
||||
new-lines:
|
||||
type: unix
|
||||
trailing-spaces: disable
|
||||
truthy: disable
|
600
roles/xanmanning.k3s/CHANGELOG.md
Normal file
600
roles/xanmanning.k3s/CHANGELOG.md
Normal file
|
@ -0,0 +1,600 @@
|
|||
# Change Log
|
||||
|
||||
<!--
|
||||
## DATE, vx.x.x
|
||||
|
||||
### Notable changes
|
||||
|
||||
### Breaking changes
|
||||
|
||||
### Known issues
|
||||
|
||||
### Contributors
|
||||
|
||||
---
|
||||
-->
|
||||
|
||||
---
|
||||
|
||||
## 2022-06-17, v3.2.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- feature: added support for alpine #182
|
||||
- fix: `k3s_control_token` not working #187
|
||||
|
||||
## 2022-05-02, v3.1.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- fix: molecule tests
|
||||
|
||||
---
|
||||
|
||||
## 2022-02-18, v3.1.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- fix: support nftables for debian 11
|
||||
|
||||
### Contributors
|
||||
|
||||
- [eaglesemanation](https://github.com/eaglesemanation)
|
||||
|
||||
---
|
||||
|
||||
## 2022-01-30, v3.1.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- feat: use basename of url for items in `k3s_server_manifests_urls` and
|
||||
`k3s_server_pod_manifests_urls` if filename is not provided #177
|
||||
|
||||
### Contributors
|
||||
|
||||
- [kossmac](https://github.com/kossmac)
|
||||
|
||||
---
|
||||
|
||||
## 2022-01-06, v3.0.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- fix: adding become to pre checks packages #173
|
||||
|
||||
### Contributors
|
||||
|
||||
- [xlejo](https://github.com/xlejo)
|
||||
|
||||
---
|
||||
|
||||
## 2022-01-02, v3.0.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- feat: Flattened task filesystem
|
||||
- feat: Moved some tasks into `vars/` as templated variables
|
||||
- feat: Airgap installation method added #165
|
||||
|
||||
### Breaking changes
|
||||
|
||||
- Minimum `python` version on targets is 3.6
|
||||
- `k3s_become_for_all` renamed to `k3s_become`
|
||||
- `k3s_become_for_*` removed.
|
||||
|
||||
### Contributors
|
||||
|
||||
- [crutonjohn](https://github.com/crutonjohn)
|
||||
|
||||
---
|
||||
|
||||
## 2021-12-23, v2.12.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fix typo in systemd unit file
|
||||
|
||||
### Contributors
|
||||
|
||||
- [andrewchen5678](https://github.com/andrewchen5678)
|
||||
|
||||
---
|
||||
|
||||
## 2021-12-20, v2.12.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fix RockyLinux HA etcd tests
|
||||
- add Debian 11 test
|
||||
- Fix Snapshotter in Molecule tests
|
||||
- Added missing documentation for `k3s_api_url`
|
||||
- Added option to change K3s updates API url
|
||||
- Custom environment variables in systemd unit files
|
||||
- Debian Bullseye support
|
||||
- Fix HA etcd cluster startup
|
||||
- Fix rootless for Debian
|
||||
|
||||
### Contributors
|
||||
|
||||
- [janar153](https://github.com/janar153)
|
||||
|
||||
---
|
||||
|
||||
## 2021-10-10, v2.11.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- docs: fixed references to `write-kubeconfig-mode` to set correct permissions #157
|
||||
- fix: Flag --delete-local-data has been deprecated #159
|
||||
|
||||
---
|
||||
|
||||
## 2021-09-08, v2.11.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- docs: example of IPv6 configuration
|
||||
- feat: checks for s3 backup configuration
|
||||
- feat: implement config.yaml.d
|
||||
|
||||
### Contributors
|
||||
|
||||
- [onedr0p](https://github.com/onedr0p)
|
||||
|
||||
---
|
||||
|
||||
## 2021-08-18, v2.10.6
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fix: Define registration address from node-ip #142
|
||||
|
||||
---
|
||||
|
||||
## 2021-08-14, v2.10.5
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Add advertised address #139
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@abelfodil](https://github.com/abelfodil)
|
||||
|
||||
---
|
||||
|
||||
## 2021-07-24, v2.10.4
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Updated systemd template to use token when joining a cluster #138
|
||||
|
||||
---
|
||||
|
||||
## 2021-07-21, v2.10.3
|
||||
|
||||
### Notable changes
|
||||
|
||||
- fix: typo #133
|
||||
- fix: restore clustering and avoid failure with jinja2_native=true #135
|
||||
- fix: do ignore etcd member count when uninstalling #136
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@Yaro](https://github.com/Yajo)
|
||||
|
||||
---
|
||||
|
||||
## 2021-06-22, v2.10.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Role is now tested against RockyLinux
|
||||
|
||||
---
|
||||
|
||||
## 2021-05-30, v2.10.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Case insensitive control node lookup #126
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@mrobinsn](https://github.com/mrobinsn)
|
||||
|
||||
---
|
||||
|
||||
## 2021-05-27, v2.10.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Only deploy templates on primary controller #119
|
||||
- Allow control plane static pods #120
|
||||
- Add support for specifying URLs in templates #124
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@bjw-s](https://github.com/bjw-s)
|
||||
- [@onedr0p](https://github.com/onedr0p)
|
||||
|
||||
---
|
||||
|
||||
## 2021-05-14, v2.9.1
|
||||
|
||||
<!-- Today was a better day... <3 -->
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Documentation, remove references to deprecated configuration techniques #115
|
||||
- Bugfix: Templating issue.
|
||||
|
||||
---
|
||||
|
||||
## 2021-05-13, v2.9.0
|
||||
|
||||
<!-- a shit day... -->
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Feature: Support k3s private registry configuration #114
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@anjia0532](https://github.com/anjia0532)
|
||||
|
||||
---
|
||||
|
||||
## 2021-05-06, v2.8.5
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bugfix: Unmount CSI plugin folder to avoid data lost on uninstall #113
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@angelnu](https://github.com/angelnu)
|
||||
|
||||
---
|
||||
|
||||
## 2021-05-01, v2.8.4
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fixed issue with draining nodes #112
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@anjia0532](https://github.com/anjia0532)
|
||||
|
||||
---
|
||||
|
||||
## 2021-04-18, v2.8.3
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Typo fix in README.md #110
|
||||
- Fixed check mode for cgroup test #111
|
||||
- Added check mode into molecule test sequence
|
||||
- `inventory.yml` is now `blockinfile`
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@bdronneau](https://github.com/bdronneau)
|
||||
|
||||
---
|
||||
|
||||
## 2021-04-10, v2.8.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- #105 - Added Ansible v2.9.16 support
|
||||
- #102 - Pre-check for cgroup status
|
||||
|
||||
### Known issues
|
||||
|
||||
- As per README.md, you require `ansible` >= 2.9.16
|
||||
or `ansible-base` >= 2.10.4. See [#105(comment)](https://github.com/PyratLabs/ansible-role-k3s/issues/105#issuecomment-817182233)
|
||||
|
||||
---
|
||||
|
||||
## 2021-03-22, v2.8.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- #100 - Fixed typo in README.md
|
||||
|
||||
### Contributors
|
||||
|
||||
- [@mbwmbw1337](https://github.com/mbwmbw1337)
|
||||
|
||||
---
|
||||
|
||||
## 2021-03-14, v2.8.0
|
||||
|
||||
Happy π day!
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Updated GitHub Actions, resolved linting errors.
|
||||
- Renamed `k3s_control_node_address` -> `k3s_registration_address`
|
||||
|
||||
### Breaking changes
|
||||
|
||||
- A task has been added to rename `k3s_control_node_address` to
|
||||
`k3s_registration_address` for any users still using this variable name,
|
||||
however this might still break something.
|
||||
|
||||
---
|
||||
|
||||
## 2021-02-28, v2.7.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bugfix, missing become on cluster token check.
|
||||
|
||||
---
|
||||
|
||||
## 2021-02-27, v2.7.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Cluster init checks added.
|
||||
- Tidy up of tasks, failed checks.
|
||||
- Possible fix for #93 - force draining of nodes added.
|
||||
|
||||
---
|
||||
|
||||
## 2021-02-27, v2.6.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bugfix: Templating error for single control plane nodes using Etcd.
|
||||
- Bugfix: a number of typos fixed.
|
||||
|
||||
---
|
||||
|
||||
## 2021-02-16, v2.6.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Tidy up of `when` params and `assert` tasks to be more readable.
|
||||
- Added feature to tweak K3S service dependencies.
|
||||
- Updated documentation:
|
||||
- Node labels and component arguments
|
||||
- systemd config
|
||||
- Use alternate CNI (Calico example)
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-31, v2.5.3
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bugfix, missing update to minimum ansible version var #91.
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-30, v2.5.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bugfix, missing `k3s_start_on_boot` to control `systemd.enabled` added.
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-30, v2.5.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Added uninstall task to remove hard-linked files #88
|
||||
- Fixed missing become for `systemd` operations tasks. #89
|
||||
- Added `k3s_start_on_boot` to control `systemd.enabled`.
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-24, v2.5.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Added support for Ansible >= 2.9.17 #83
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-23, v2.4.3
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bufgix: Installation hangs on "Check that all nodes to be ready" #84
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-10, v2.4.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Bufgix: Docker check still failing on "false"
|
||||
|
||||
---
|
||||
|
||||
## 2021-01-02, v2.4.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fixed issue with armv6l (Raspberry Pi Zero W)
|
||||
- Added path for private repositories config to directory creation list.
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-21, v2.4.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- `k3s_config_dir` derived from `k3s_config_file`, reused throughout the role
|
||||
to allow for easy removal of "Rancher" references #73.
|
||||
- `k3s_token_location` has moved to be in `k3s_config_dir`.
|
||||
- Tasks for creating directories now looped to caputure configuration from
|
||||
`k3s_server` and `k3s_agent` and ensure directories exist before k3s
|
||||
starts, see #75.
|
||||
- Server token collected directly from token file, not symlinked file
|
||||
(node-token).
|
||||
- `k3s_runtime_config` defined in `vars/` for validation and overwritten in
|
||||
tasks for control plane and workers.
|
||||
- Removed unused references to GitHub API.
|
||||
- `set_fact` and `command` tasks now use FQCN.
|
||||
- Check of `ansible_version` in environment check.
|
||||
- Introduction of target environment checks for #72.
|
||||
- Fixed bug with non-default listening port not being passed to workers.
|
||||
- Added ability to put documentation links into validation checks #76.
|
||||
- Removed the requirement for `jmespath` on the Ansible controller.
|
||||
- Fixed bug with issue data collection tasks.
|
||||
|
||||
### Breaking changes
|
||||
|
||||
- Ansible minimum version is hard set to v2.10.4
|
||||
- `k3s_token_location` has moved to be in `k3s_config_dir` so re-running the
|
||||
role will create a duplicate file here.
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-19, v2.3.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Updated k3s uninstall scripts #74
|
||||
- Started moving Rancher references to `vars/` as per #73
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-19, v2.2.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fixed typos in documentation.
|
||||
- Molecule testing pinned to v3.1 due to tests failing.
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-16, v2.2.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Re-working documentation
|
||||
- Updated GitHub link, org changed from Rancher to k3s-io.
|
||||
- Replace deprecated `play_hosts` variable.
|
||||
|
||||
### Breaking changes
|
||||
|
||||
- Moving git branch from `master` to `main`.
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-12, v2.2.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Use of FQCNs enforced, minimum Ansible version now v2.10
|
||||
- `k3s_etcd_datastore` no longer experimental after K3s version v1.19.5+k3s1
|
||||
- Docker marked as deprecated for K3s > v1.20.0+k3s1
|
||||
|
||||
### Breaking changes
|
||||
|
||||
- Use of FQCNs enforced, minimum Ansible version now v2.10
|
||||
- Use of Docker requires `k3s_use_unsupported_config` to be `true` after
|
||||
v1.20.0+k3s1
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-05, v2.1.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fixed link to documentation.
|
||||
|
||||
---
|
||||
|
||||
## 2020-12-05, v2.1.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Deprecated configuration check built into validation steps.
|
||||
- Removed duplicated tasks for single node cluster.
|
||||
- Added documentation providing quickstart examples and common operations.
|
||||
- Fixed data-dir configuration.
|
||||
- Some tweaks to rootless.
|
||||
- Fix draining and removing of nodes.
|
||||
|
||||
### Breaking changes
|
||||
|
||||
- `k3s_token_location` now points to a file location, not a directory.
|
||||
- `k3s_systemd_unit_directory` renamed to `k3s_systemd_unit_dir`
|
||||
- Removed `k3s_node_data_dir` as this is now configured with `data-dir` in
|
||||
`k3s_server` and/or `k3s_agent`.
|
||||
|
||||
### Known issues
|
||||
|
||||
- Rootless is still broken, this is still not supported as a method for
|
||||
running k3s using this role.
|
||||
|
||||
---
|
||||
|
||||
## 2020-11-30, v2.0.2
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Updated issue template and information collection tasks.
|
||||
|
||||
---
|
||||
|
||||
## 2020-11-30, v2.0.1
|
||||
|
||||
### Notable changes
|
||||
|
||||
- Fixed a number of typos in the README.md
|
||||
- Updated the meta/main.yml to put quotes around minimum Ansible version.
|
||||
|
||||
---
|
||||
|
||||
## 2020-11-29, v2.0.0
|
||||
|
||||
### Notable changes
|
||||
|
||||
- #64 - Initial release of v2.0.0 of
|
||||
[ansible-role-k3s](https://github.com/PyratLabs/ansible-role-k3s).
|
||||
- Minimum supported k3s version now: v1.19.1+k3s1
|
||||
- Minimum supported Ansible version now: v2.10.0
|
||||
- #62 - Remove all references to the word "master".
|
||||
- #53 - Move to file-based configuration.
|
||||
- Refactored to avoid duplication in code and make contribution easier.
|
||||
- Validation checks moved to using variables defined in `vars/`
|
||||
|
||||
### Breaking changes
|
||||
|
||||
#### File based configuration
|
||||
|
||||
Issue #53
|
||||
|
||||
With the release of v1.19.1+k3s1, this role has moved to file-based
|
||||
configuration of k3s. This requires manuall translation of v1 configuration
|
||||
variables into configuration file format.
|
||||
|
||||
Please see: https://rancher.com/docs/k3s/latest/en/installation/install-options/#configuration-file
|
||||
|
||||
#### Minimum supported k3s version
|
||||
|
||||
As this role now relies on file-based configuration, the v2.x release of this
|
||||
role will only support v1.19+ of k3s. If you are not in a position to update
|
||||
k3s you will need to continue using the v1.x release of this role, which will
|
||||
be supported until March 2021<!-- 1 year after k8s v1.18 release -->.
|
||||
|
||||
#### Minimum supported ansible version
|
||||
|
||||
This role now only supports Ansible v2.10+, this is because it has moved on to
|
||||
using FQDNs, with the exception of `set_fact` tasks which have
|
||||
[been broken](https://github.com/ansible/ansible/issues/72319) and the fixes
|
||||
have [not yet been backported to v2.10](https://github.com/ansible/ansible/pull/71824).
|
||||
|
||||
The use of FQDNs allows for custom modules to be introduced to override task
|
||||
behavior. If this role requires a custom ansible module to be introduced then
|
||||
this can be added as a dependency and targeted specifically by using the
|
||||
correct FQDN.
|
46
roles/xanmanning.k3s/CONTRIBUTING.md
Normal file
46
roles/xanmanning.k3s/CONTRIBUTING.md
Normal file
|
@ -0,0 +1,46 @@
|
|||
# Contribution Guidelines
|
||||
|
||||
Thank you for taking time to contribute to this Ansible role.
|
||||
|
||||
There are a number of ways that you can contribute to this project, not all of
|
||||
them requiring you to be able to write code. Below is a list of suggested
|
||||
contributions welcomed by the community:
|
||||
|
||||
- Submit bug reports in GitHub issues
|
||||
- Comment on bug reports with futher information or suggestions
|
||||
- Suggest new features
|
||||
- Create Pull Requests fixing bugs or adding new features
|
||||
- Update and improve documentation
|
||||
- Review the role on Ansible Galaxy
|
||||
- Write a blog post reviewing the role
|
||||
- Sponsor me.
|
||||
|
||||
## Issue guidelines
|
||||
|
||||
Issues are the best way to capture an bug in the role, or suggest new features.
|
||||
This is due to issues being visible to the entire community and allows for
|
||||
other contributors to pick up the work, so is a better communication medium
|
||||
than email.
|
||||
|
||||
A good bug issue will include as much information as possible about the
|
||||
environment Ansible is running in, as well as the role configuration. If there
|
||||
are any relevant pieces of documentation from upstream projects, this should
|
||||
be included.
|
||||
|
||||
New feature requests are also best captured in issues, these should include
|
||||
as much relevant information as possible and if possible include a "user story"
|
||||
(don't sweat if you don't know how to write one). If there are any relevant
|
||||
pieces of documentation from upstream projects, this should be included.
|
||||
|
||||
## Pull request guidelines
|
||||
|
||||
PRs should only contain 1 issue fix at a time to limit the scope of testing
|
||||
required. The smaller the scope of the PR, the easier it is for it to be
|
||||
reviewed.
|
||||
|
||||
PRs should include the keyword `Fixes` before an issue number if the PR will
|
||||
completely close the issue. This is because automation will close the issue
|
||||
once the PR is merged.
|
||||
|
||||
PRs are preferred to be merged in as a single commit, so rebasing before
|
||||
pushing is recommended, however this isn't a strict rule.
|
30
roles/xanmanning.k3s/LICENSE.txt
Normal file
30
roles/xanmanning.k3s/LICENSE.txt
Normal file
|
@ -0,0 +1,30 @@
|
|||
BSD 3-Clause License
|
||||
|
||||
Copyright (c) 2020, Xan Manning
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions are met:
|
||||
|
||||
1. Redistributions of source code must retain the above copyright notice, this
|
||||
list of conditions and the following disclaimer.
|
||||
|
||||
2. Redistributions in binary form must reproduce the above copyright notice,
|
||||
this list of conditions and the following disclaimer in the documentation
|
||||
and/or other materials provided with the distribution.
|
||||
|
||||
3. Neither the name of the copyright holder nor the names of its
|
||||
contributors may be used to endorse or promote products derived from
|
||||
this software without specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
||||
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
||||
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
||||
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
412
roles/xanmanning.k3s/README.md
Normal file
412
roles/xanmanning.k3s/README.md
Normal file
|
@ -0,0 +1,412 @@
|
|||
# Ansible Role: k3s (v3.x)
|
||||
|
||||
Ansible role for installing [K3S](https://k3s.io/) ("Lightweight
|
||||
Kubernetes") as either a standalone server or cluster.
|
||||
|
||||
[![CI](https://github.com/PyratLabs/ansible-role-k3s/workflows/CI/badge.svg?event=push)](https://github.com/PyratLabs/ansible-role-k3s/actions?query=workflow%3ACI)
|
||||
|
||||
## Help Wanted!
|
||||
|
||||
Hi! :wave: [@xanmanning](https://github.com/xanmanning) is looking for a new
|
||||
maintainer to work on this Ansible role. This is because I don't have as much
|
||||
free time any more and I no longer write Ansible regularly as part of my day
|
||||
job. If you're interested, get in touch.
|
||||
|
||||
## Release notes
|
||||
|
||||
Please see [Releases](https://github.com/PyratLabs/ansible-role-k3s/releases)
|
||||
and [CHANGELOG.md](CHANGELOG.md).
|
||||
|
||||
## Requirements
|
||||
|
||||
The host you're running Ansible from requires the following Python dependencies:
|
||||
|
||||
- `python >= 3.6.0` - [See Notes below](#important-note-about-python).
|
||||
- `ansible >= 2.9.16` or `ansible-base >= 2.10.4`
|
||||
|
||||
You can install dependencies using the requirements.txt file in this repository:
|
||||
`pip3 install -r requirements.txt`.
|
||||
|
||||
This role has been tested against the following Linux Distributions:
|
||||
|
||||
- Alpine Linux
|
||||
- Amazon Linux 2
|
||||
- Archlinux
|
||||
- CentOS 8
|
||||
- Debian 11
|
||||
- Fedora 31
|
||||
- Fedora 32
|
||||
- Fedora 33
|
||||
- openSUSE Leap 15
|
||||
- RockyLinux 8
|
||||
- Ubuntu 20.04 LTS
|
||||
|
||||
:warning: The v3 releases of this role only supports `k3s >= v1.19`, for
|
||||
`k3s < v1.19` please consider updating or use the v1.x releases of this role.
|
||||
|
||||
Before upgrading, see [CHANGELOG](CHANGELOG.md) for notifications of breaking
|
||||
changes.
|
||||
|
||||
## Role Variables
|
||||
|
||||
Since K3s [v1.19.1+k3s1](https://github.com/k3s-io/k3s/releases/tag/v1.19.1%2Bk3s1)
|
||||
you can now configure K3s using a
|
||||
[configuration file](https://rancher.com/docs/k3s/latest/en/installation/install-options/#configuration-file)
|
||||
rather than environment variables or command line arguments. The v2 release of
|
||||
this role has moved to the configuration file method rather than populating a
|
||||
systemd unit file with command-line arguments. There may be exceptions that are
|
||||
defined in [Global/Cluster Variables](#globalcluster-variables), however you will
|
||||
mostly be configuring k3s by configuration files using the `k3s_server` and
|
||||
`k3s_agent` variables.
|
||||
|
||||
See "_Server (Control Plane) Configuration_" and "_Agent (Worker) Configuraion_"
|
||||
below.
|
||||
|
||||
### Global/Cluster Variables
|
||||
|
||||
Below are variables that are set against all of the play hosts for environment
|
||||
consistency. These are generally cluster-level configuration.
|
||||
|
||||
| Variable | Description | Default Value |
|
||||
|--------------------------------------|--------------------------------------------------------------------------------------------|--------------------------------|
|
||||
| `k3s_state` | State of k3s: installed, started, stopped, downloaded, uninstalled, validated. | installed |
|
||||
| `k3s_release_version` | Use a specific version of k3s, eg. `v0.2.0`. Specify `false` for stable. | `false` |
|
||||
| `k3s_airgap` | Boolean to enable air-gapped installations | `false` |
|
||||
| `k3s_config_file` | Location of the k3s configuration file. | `/etc/rancher/k3s/config.yaml` |
|
||||
| `k3s_build_cluster` | When multiple play hosts are available, attempt to cluster. Read notes below. | `true` |
|
||||
| `k3s_registration_address` | Fixed registration address for nodes. IP or FQDN. | NULL |
|
||||
| `k3s_github_url` | Set the GitHub URL to install k3s from. | https://github.com/k3s-io/k3s |
|
||||
| `k3s_api_url` | URL for K3S updates API. | https://update.k3s.io |
|
||||
| `k3s_install_dir` | Installation directory for k3s. | `/usr/local/bin` |
|
||||
| `k3s_install_hard_links` | Install using hard links rather than symbolic links. | `false` |
|
||||
| `k3s_server_config_yaml_d_files` | A flat list of templates to supplement the `k3s_server` configuration. | [] |
|
||||
| `k3s_agent_config_yaml_d_files` | A flat list of templates to supplement the `k3s_agent` configuration. | [] |
|
||||
| `k3s_server_manifests_urls` | A list of URLs to deploy on the primary control plane. Read notes below. | [] |
|
||||
| `k3s_server_manifests_templates` | A flat list of templates to deploy on the primary control plane. | [] |
|
||||
| `k3s_server_pod_manifests_urls` | A list of URLs for installing static pod manifests on the control plane. Read notes below. | [] |
|
||||
| `k3s_server_pod_manifests_templates` | A flat list of templates for installing static pod manifests on the control plane. | [] |
|
||||
| `k3s_use_experimental` | Allow the use of experimental features in k3s. | `false` |
|
||||
| `k3s_use_unsupported_config` | Allow the use of unsupported configurations in k3s. | `false` |
|
||||
| `k3s_etcd_datastore` | Enable etcd embedded datastore (read notes below). | `false` |
|
||||
| `k3s_debug` | Enable debug logging on the k3s service. | `false` |
|
||||
| `k3s_registries` | Registries configuration file content. | `{ mirrors: {}, configs:{} }` |
|
||||
|
||||
### K3S Service Configuration
|
||||
|
||||
The below variables change how and when the systemd service unit file for K3S
|
||||
is run. Use this with caution, please refer to the [systemd documentation](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#%5BUnit%5D%20Section%20Options)
|
||||
for more information.
|
||||
|
||||
| Variable | Description | Default Value |
|
||||
|------------------------|----------------------------------------------------------------------|---------------|
|
||||
| `k3s_start_on_boot` | Start k3s on boot. | `true` |
|
||||
| `k3s_service_requires` | List of required systemd units to k3s service unit. | [] |
|
||||
| `k3s_service_wants` | List of "wanted" systemd unit to k3s (weaker than "requires"). | []\* |
|
||||
| `k3s_service_before` | Start k3s before a defined list of systemd units. | [] |
|
||||
| `k3s_service_after` | Start k3s after a defined list of systemd units. | []\* |
|
||||
| `k3s_service_env_vars` | Dictionary of environment variables to use within systemd unit file. | {} |
|
||||
| `k3s_service_env_file` | Location on host of a environment file to include. | `false`\*\* |
|
||||
|
||||
\* The systemd unit template **always** specifies `network-online.target` for
|
||||
`wants` and `after`.
|
||||
|
||||
\*\* The file must already exist on the target host, this role will not create
|
||||
nor manage the file. You can manage this file outside of the role with
|
||||
pre-tasks in your Ansible playbook.
|
||||
|
||||
### Group/Host Variables
|
||||
|
||||
Below are variables that are set against individual or groups of play hosts.
|
||||
Typically you'd set these at group level for the control plane or worker nodes.
|
||||
|
||||
| Variable | Description | Default Value |
|
||||
|--------------------|-------------------------------------------------------------------|---------------------------------------------------|
|
||||
| `k3s_control_node` | Specify if a host (or host group) are part of the control plane. | `false` (role will automatically delegate a node) |
|
||||
| `k3s_server` | Server (control plane) configuration, see notes below. | `{}` |
|
||||
| `k3s_agent` | Agent (worker) configuration, see notes below. | `{}` |
|
||||
|
||||
#### Server (Control Plane) Configuration
|
||||
|
||||
The control plane is configured with the `k3s_server` dict variable. Please
|
||||
refer to the below documentation for configuration options:
|
||||
|
||||
https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
|
||||
|
||||
The `k3s_server` dictionary variable will contain flags from the above
|
||||
(removing the `--` prefix). Below is an example:
|
||||
|
||||
```yaml
|
||||
k3s_server:
|
||||
datastore-endpoint: postgres://postgres:verybadpass@database:5432/postgres?sslmode=disable
|
||||
cluster-cidr: 172.20.0.0/16
|
||||
flannel-backend: 'none' # This needs to be in quotes
|
||||
disable:
|
||||
- traefik
|
||||
- coredns
|
||||
```
|
||||
|
||||
Alternatively, you can create a .yaml file and read it in to the `k3s_server`
|
||||
variable as per the below example:
|
||||
|
||||
```yaml
|
||||
k3s_server: "{{ lookup('file', 'path/to/k3s_server.yml') | from_yaml }}"
|
||||
```
|
||||
|
||||
Check out the [Documentation](documentation/README.md) for example
|
||||
configuration.
|
||||
|
||||
#### Agent (Worker) Configuration
|
||||
|
||||
Workers are configured with the `k3s_agent` dict variable. Please refer to the
|
||||
below documentation for configuration options:
|
||||
|
||||
https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config
|
||||
|
||||
The `k3s_agent` dictionary variable will contain flags from the above
|
||||
(removing the `--` prefix). Below is an example:
|
||||
|
||||
```yaml
|
||||
k3s_agent:
|
||||
with-node-id: true
|
||||
node-label:
|
||||
- "foo=bar"
|
||||
- "hello=world"
|
||||
```
|
||||
|
||||
Alternatively, you can create a .yaml file and read it in to the `k3s_agent`
|
||||
variable as per the below example:
|
||||
|
||||
```yaml
|
||||
k3s_agent: "{{ lookup('file', 'path/to/k3s_agent.yml') | from_yaml }}"
|
||||
```
|
||||
|
||||
Check out the [Documentation](documentation/README.md) for example
|
||||
configuration.
|
||||
|
||||
### Ansible Controller Configuration Variables
|
||||
|
||||
The below variables are used to change the way the role executes in Ansible,
|
||||
particularly with regards to privilege escalation.
|
||||
|
||||
| Variable | Description | Default Value |
|
||||
|------------------------|----------------------------------------------------------------|---------------|
|
||||
| `k3s_skip_validation` | Skip all tasks that validate configuration. | `false` |
|
||||
| `k3s_skip_env_checks` | Skip all tasks that check environment configuration. | `false` |
|
||||
| `k3s_skip_post_checks` | Skip all tasks that check post execution state. | `false` |
|
||||
| `k3s_become` | Escalate user privileges for tasks that need root permissions. | `false` |
|
||||
|
||||
#### Important note about Python
|
||||
|
||||
From v3 of this role, Python 3 is required on the target system as well as on
|
||||
the Ansible controller. This is to ensure consistent behaviour for Ansible
|
||||
tasks as Python 2 is now EOL.
|
||||
|
||||
If target systems have both Python 2 and Python 3 installed, it is most likely
|
||||
that Python 2 will be selected by default. To ensure Python 3 is used on a
|
||||
target with both versions of Python, ensure `ansible_python_interpreter` is
|
||||
set in your inventory. Below is an example inventory:
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
```
|
||||
|
||||
#### Important note about `k3s_release_version`
|
||||
|
||||
If you do not set a `k3s_release_version` the latest version from the stable
|
||||
channel of k3s will be installed. If you are developing against a specific
|
||||
version of k3s you must ensure this is set in your Ansible configuration, eg:
|
||||
|
||||
```yaml
|
||||
k3s_release_version: v1.19.3+k3s1
|
||||
```
|
||||
|
||||
It is also possible to install specific K3s "Channels", below are some
|
||||
examples for `k3s_release_version`:
|
||||
|
||||
```yaml
|
||||
k3s_release_version: false # defaults to 'stable' channel
|
||||
k3s_release_version: stable # latest 'stable' release
|
||||
k3s_release_version: testing # latest 'testing' release
|
||||
k3s_release_version: v1.19 # latest 'v1.19' release
|
||||
k3s_release_version: v1.19.3+k3s3 # specific release
|
||||
|
||||
# Specific commit
|
||||
# CAUTION - only used for testing - must be 40 characters
|
||||
k3s_release_version: 48ed47c4a3e420fa71c18b2ec97f13dc0659778b
|
||||
```
|
||||
|
||||
#### Important note about `k3s_install_hard_links`
|
||||
|
||||
If you are using the [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller)
|
||||
you will need to use hard links rather than symbolic links as the controller
|
||||
will not be able to follow symbolic links. This option has been added however
|
||||
is not enabled by default to avoid breaking existing installations.
|
||||
|
||||
To enable the use of hard links, ensure `k3s_install_hard_links` is set
|
||||
to `true`.
|
||||
|
||||
```yaml
|
||||
k3s_install_hard_links: true
|
||||
```
|
||||
|
||||
The result of this can be seen by running the following in `k3s_install_dir`:
|
||||
|
||||
`ls -larthi | grep -E 'k3s|ctr|ctl' | grep -vE ".sh$" | sort`
|
||||
|
||||
Symbolic Links:
|
||||
|
||||
```text
|
||||
[root@node1 bin]# ls -larthi | grep -E 'k3s|ctr|ctl' | grep -vE ".sh$" | sort
|
||||
3277823 -rwxr-xr-x 1 root root 52M Jul 25 12:50 k3s-v1.18.4+k3s1
|
||||
3279565 lrwxrwxrwx 1 root root 31 Jul 25 12:52 k3s -> /usr/local/bin/k3s-v1.18.6+k3s1
|
||||
3279644 -rwxr-xr-x 1 root root 51M Jul 25 12:52 k3s-v1.18.6+k3s1
|
||||
3280079 lrwxrwxrwx 1 root root 31 Jul 25 12:52 ctr -> /usr/local/bin/k3s-v1.18.6+k3s1
|
||||
3280080 lrwxrwxrwx 1 root root 31 Jul 25 12:52 crictl -> /usr/local/bin/k3s-v1.18.6+k3s1
|
||||
3280081 lrwxrwxrwx 1 root root 31 Jul 25 12:52 kubectl -> /usr/local/bin/k3s-v1.18.6+k3s1
|
||||
```
|
||||
|
||||
Hard Links:
|
||||
|
||||
```text
|
||||
[root@node1 bin]# ls -larthi | grep -E 'k3s|ctr|ctl' | grep -vE ".sh$" | sort
|
||||
3277823 -rwxr-xr-x 1 root root 52M Jul 25 12:50 k3s-v1.18.4+k3s1
|
||||
3279644 -rwxr-xr-x 5 root root 51M Jul 25 12:52 crictl
|
||||
3279644 -rwxr-xr-x 5 root root 51M Jul 25 12:52 ctr
|
||||
3279644 -rwxr-xr-x 5 root root 51M Jul 25 12:52 k3s
|
||||
3279644 -rwxr-xr-x 5 root root 51M Jul 25 12:52 k3s-v1.18.6+k3s1
|
||||
3279644 -rwxr-xr-x 5 root root 51M Jul 25 12:52 kubectl
|
||||
```
|
||||
|
||||
#### Important note about `k3s_build_cluster`
|
||||
|
||||
If you set `k3s_build_cluster` to `false`, this role will install each play
|
||||
host as a standalone node. An example of when you might use this would be
|
||||
when building a large number of standalone IoT devices running K3s. Below is a
|
||||
hypothetical situation where we are to deploy 25 Raspberry Pi devices, each a
|
||||
standalone system and not a cluster of 25 nodes. To do this we'd use a playbook
|
||||
similar to the below:
|
||||
|
||||
```yaml
|
||||
- hosts: k3s_nodes # eg. 25 RPi's defined in our inventory.
|
||||
vars:
|
||||
k3s_build_cluster: false
|
||||
roles:
|
||||
- xanmanning.k3s
|
||||
```
|
||||
|
||||
#### Important note about `k3s_control_node` and High Availability (HA)
|
||||
|
||||
By default only one host will be defined as a control node by Ansible, If you
|
||||
do not set a host as a control node, this role will automatically delegate
|
||||
the first play host as a control node. This is not suitable for use within
|
||||
a Production workload.
|
||||
|
||||
If multiple hosts have `k3s_control_node` set to `true`, you must also set
|
||||
`datastore-endpoint` in `k3s_server` as the connection string to a MySQL or
|
||||
PostgreSQL database, or external Etcd cluster else the play will fail.
|
||||
|
||||
If using TLS, the CA, Certificate and Key need to already be available on
|
||||
the play hosts.
|
||||
|
||||
See: [High Availability with an External DB](https://rancher.com/docs/k3s/latest/en/installation/ha/)
|
||||
|
||||
It is also possible, though not supported, to run a single K3s control node
|
||||
with a `datastore-endpoint` defined. As this is not a typically supported
|
||||
configuration you will need to set `k3s_use_unsupported_config` to `true`.
|
||||
|
||||
Since K3s v1.19.1 it is possible to use an embedded Etcd as the backend
|
||||
database, and this is done by setting `k3s_etcd_datastore` to `true`.
|
||||
The best practice for Etcd is to define at least 3 members to ensure quorum is
|
||||
established. In addition to this, an odd number of members is recommended to
|
||||
ensure a majority in the event of a network partition. If you want to use 2
|
||||
members or an even number of members, please set `k3s_use_unsupported_config`
|
||||
to `true`.
|
||||
|
||||
#### Important note about `k3s_server_manifests_urls` and `k3s_server_pod_manifests_urls`
|
||||
|
||||
To deploy server manifests and server pod manifests from URL, you need to
|
||||
specify a `url` and optionally a `filename` (if none provided basename is used). Below is an example of how to deploy the
|
||||
Tigera operator for Calico and kube-vip.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_server_manifests_urls:
|
||||
- url: https://docs.projectcalico.org/archive/v3.19/manifests/tigera-operator.yaml
|
||||
filename: tigera-operator.yaml
|
||||
|
||||
k3s_server_pod_manifests_urls:
|
||||
- url: https://raw.githubusercontent.com/kube-vip/kube-vip/main/example/deploy/0.1.4.yaml
|
||||
filename: kube-vip.yaml
|
||||
|
||||
```
|
||||
|
||||
#### Important note about `k3s_airgap`
|
||||
|
||||
When deploying k3s in an air gapped environment you should provide the `k3s` binary in `./files/`. The binary will not be downloaded from Github and will subsequently not be verified using the provided sha256 sum, nor able to verify the version that you are running. All risks and burdens associated are assumed by the user in this scenario.
|
||||
|
||||
## Dependencies
|
||||
|
||||
No dependencies on other roles.
|
||||
|
||||
## Example Playbooks
|
||||
|
||||
Example playbook, single control node running `testing` channel k3s:
|
||||
|
||||
```yaml
|
||||
- hosts: k3s_nodes
|
||||
vars:
|
||||
k3s_release_version: testing
|
||||
roles:
|
||||
- role: xanmanning.k3s
|
||||
```
|
||||
|
||||
Example playbook, Highly Available with PostgreSQL database running the latest
|
||||
stable release:
|
||||
|
||||
```yaml
|
||||
- hosts: k3s_nodes
|
||||
vars:
|
||||
k3s_registration_address: loadbalancer # Typically a load balancer.
|
||||
k3s_server:
|
||||
datastore-endpoint: "postgres://postgres:verybadpass@database:5432/postgres?sslmode=disable"
|
||||
pre_tasks:
|
||||
- name: Set each node to be a control node
|
||||
ansible.builtin.set_fact:
|
||||
k3s_control_node: true
|
||||
when: inventory_hostname in ['node2', 'node3']
|
||||
roles:
|
||||
- role: xanmanning.k3s
|
||||
```
|
||||
|
||||
## License
|
||||
|
||||
[BSD 3-clause](LICENSE.txt)
|
||||
|
||||
## Contributors
|
||||
|
||||
Contributions from the community are very welcome, but please read the
|
||||
[contribution guidelines](CONTRIBUTING.md) before doing so, this will help
|
||||
make things as streamlined as possible.
|
||||
|
||||
Also, please check out the awesome
|
||||
[list of contributors](https://github.com/PyratLabs/ansible-role-k3s/graphs/contributors).
|
||||
|
||||
## Author Information
|
||||
|
||||
[Xan Manning](https://xan.manning.io/)
|
157
roles/xanmanning.k3s/defaults/main.yml
Normal file
157
roles/xanmanning.k3s/defaults/main.yml
Normal file
|
@ -0,0 +1,157 @@
|
|||
---
|
||||
|
||||
##
|
||||
# Global/Cluster Configuration
|
||||
##
|
||||
|
||||
# k3s state, options: installed, started, stopped, restarted, uninstalled, validated
|
||||
# (default: installed)
|
||||
k3s_state: installed
|
||||
|
||||
# Use a specific k3s version, if set to "false" we will get the latest
|
||||
# k3s_release_version: v1.19.3
|
||||
k3s_release_version: false
|
||||
|
||||
# Location of the k3s configuration file
|
||||
k3s_config_file: "/etc/rancher/k3s/config.yaml"
|
||||
|
||||
# Location of the k3s configuration directory
|
||||
k3s_config_yaml_d_dir: "/etc/rancher/k3s/config.yaml.d"
|
||||
|
||||
# When multiple ansible_play_hosts are present, attempt to cluster the nodes.
|
||||
# Using false will create multiple standalone nodes.
|
||||
# (default: true)
|
||||
k3s_build_cluster: true
|
||||
|
||||
# URL for GitHub project
|
||||
k3s_github_url: https://github.com/k3s-io/k3s
|
||||
|
||||
# URL for K3s updates API
|
||||
k3s_api_url: https://update.k3s.io
|
||||
|
||||
# Install K3s in Air Gapped scenarios
|
||||
k3s_airgap: false
|
||||
|
||||
# Skip all tasks that validate configuration
|
||||
k3s_skip_validation: false
|
||||
|
||||
# Skip all tasks that check environment configuration
|
||||
k3s_skip_env_checks: false
|
||||
|
||||
# Skip post-checks
|
||||
k3s_skip_post_checks: false
|
||||
|
||||
# Installation directory for k3s
|
||||
k3s_install_dir: /usr/local/bin
|
||||
|
||||
# Install using hard links rather than symbolic links
|
||||
k3s_install_hard_links: false
|
||||
|
||||
# A list of templates used for configuring the server.
|
||||
k3s_server_config_yaml_d_files: []
|
||||
|
||||
# A list of templates used for configuring the agent.
|
||||
k3s_agent_config_yaml_d_files: []
|
||||
|
||||
# A list of templates used for pre-configuring the cluster.
|
||||
k3s_server_manifests_templates: []
|
||||
|
||||
# A list of URLs used for pre-configuring the cluster.
|
||||
k3s_server_manifests_urls: []
|
||||
# - url: https://some/url/to/manifest.yml
|
||||
# filename: manifest.yml
|
||||
|
||||
# A list of templates used for installing static pod manifests on the control plane.
|
||||
k3s_server_pod_manifests_templates: []
|
||||
|
||||
# A list of URLs used for installing static pod manifests on the control plane.
|
||||
k3s_server_pod_manifests_urls: []
|
||||
# - url: https://some/url/to/manifest.yml
|
||||
# filename: manifest.yml
|
||||
|
||||
# Use experimental features in k3s?
|
||||
k3s_use_experimental: false
|
||||
|
||||
# Allow for unsupported configurations in k3s?
|
||||
k3s_use_unsupported_config: false
|
||||
|
||||
# Enable etcd embedded datastore
|
||||
k3s_etcd_datastore: false
|
||||
|
||||
##
|
||||
# Systemd config
|
||||
##
|
||||
|
||||
# Start k3s on system boot
|
||||
k3s_start_on_boot: true
|
||||
|
||||
# List of required systemd units to k3s service unit.
|
||||
k3s_service_requires: []
|
||||
|
||||
# List of "wanted" systemd unit to k3s (weaker than "requires").
|
||||
k3s_service_wants: []
|
||||
|
||||
# Start k3s before a defined list of systemd units.
|
||||
k3s_service_before: []
|
||||
|
||||
# Start k3s after a defined list of systemd units.
|
||||
k3s_service_after: []
|
||||
|
||||
# Dictionary of environment variables to use within systemd unit file
|
||||
# Some examples below
|
||||
k3s_service_env_vars: {}
|
||||
# PATH: /opt/k3s/bin
|
||||
# GOGC: 10
|
||||
|
||||
# Location on host of a environment file to include. This must already exist on
|
||||
# the target as this role will not populate this file.
|
||||
k3s_service_env_file: false
|
||||
|
||||
|
||||
##
|
||||
# Server Configuration
|
||||
##
|
||||
|
||||
k3s_server: {}
|
||||
# k3s_server:
|
||||
# listen-port: 6443
|
||||
|
||||
##
|
||||
# Agent Configuration
|
||||
##
|
||||
|
||||
k3s_agent: {}
|
||||
# k3s_agent:
|
||||
# node-label:
|
||||
# - "foo=bar"
|
||||
# - "bish=bosh"
|
||||
|
||||
##
|
||||
# Ansible Controller configuration
|
||||
##
|
||||
|
||||
# Use become privileges?
|
||||
k3s_become: false
|
||||
|
||||
# Private registry configuration.
|
||||
# Rancher k3s documentation: https://rancher.com/docs/k3s/latest/en/installation/private-registry/
|
||||
k3s_registries:
|
||||
|
||||
mirrors:
|
||||
# docker.io:
|
||||
# endpoint:
|
||||
# - "https://mycustomreg.com:5000"
|
||||
configs:
|
||||
# "mycustomreg:5000":
|
||||
# auth:
|
||||
# # this is the registry username
|
||||
# username: xxxxxx
|
||||
# # this is the registry password
|
||||
# password: xxxxxx
|
||||
# tls:
|
||||
# # path to the cert file used in the registry
|
||||
# cert_file:
|
||||
# # path to the key file used in the registry
|
||||
# key_file:
|
||||
# # path to the ca file used in the registry
|
||||
# ca_file:
|
44
roles/xanmanning.k3s/documentation/README.md
Normal file
44
roles/xanmanning.k3s/documentation/README.md
Normal file
|
@ -0,0 +1,44 @@
|
|||
# ansible-role-k3s
|
||||
|
||||
This document describes a number of ways of consuming this Ansible role for use
|
||||
in your own k3s deployments. It will not be able to cover every use case
|
||||
scenario but will provide some common example configurations.
|
||||
|
||||
## Requirements
|
||||
|
||||
Before you start you will need an Ansible controller. This can either be your
|
||||
workstation, or a dedicated system that you have access to. The instructions
|
||||
in this documentation assume you are using `ansible` CLI, there are no
|
||||
instructions available for Ansible Tower at this time.
|
||||
|
||||
Follow the below guide to get Ansible installed.
|
||||
|
||||
https://docs.ansible.com/ansible/latest/installation_guide/index.html
|
||||
|
||||
## Quickstart
|
||||
|
||||
Below are quickstart examples for a single node k3s server, a k3s cluster
|
||||
with a single control node and HA k3s cluster. These represent the bare
|
||||
minimum configuration.
|
||||
|
||||
- [Single node k3s](quickstart-single-node.md)
|
||||
- [Simple k3s cluster](quickstart-cluster.md)
|
||||
- [HA k3s cluster using embedded etcd](quickstart-ha-cluster.md)
|
||||
|
||||
## Example configurations and operations
|
||||
|
||||
### Configuration
|
||||
|
||||
- [Setting up 2-node HA control plane with external datastore](configuration/2-node-ha-ext-datastore.md)
|
||||
- [Provision multiple standalone k3s nodes](configuration/multiple-standalone-k3s-nodes.md)
|
||||
- [Set node labels and component arguments](configuration/node-labels-and-component-args.md)
|
||||
- [Use an alternate CNI](configuration/use-an-alternate-cni.md)
|
||||
- [IPv4/IPv6 Dual-Stack config](configuration/ipv4-ipv6-dual-stack.md)
|
||||
- [Start K3S after another service](configuration/systemd-config.md)
|
||||
|
||||
### Operations
|
||||
|
||||
- [Stop/Start a cluster](operations/stop-start-cluster.md)
|
||||
- [Updating k3s](operations/updating-k3s.md)
|
||||
- [Extending a cluster](operations/extending-a-cluster.md)
|
||||
- [Shrinking a cluster](operations/shrinking-a-cluster.md)
|
|
@ -0,0 +1,79 @@
|
|||
# 2 Node HA Control Plane with external database
|
||||
|
||||
For this configuration we are deploying a highly available control plane
|
||||
composed of two control nodes. This can be achieved with embedded etcd, however
|
||||
etcd ideally has an odd number of nodes.
|
||||
|
||||
The example below will use an external PostgreSQL datastore to store the
|
||||
cluster state information.
|
||||
|
||||
Main guide: https://rancher.com/docs/k3s/latest/en/installation/ha/
|
||||
|
||||
## Architecture
|
||||
|
||||
```text
|
||||
+-------------------+
|
||||
| Load Balancer/VIP |
|
||||
+---------+---------+
|
||||
|
|
||||
|
|
||||
|
|
||||
|
|
||||
+------------+ | +------------+
|
||||
| | | | |
|
||||
+--------+ control-01 +<-----+----->+ control-02 |
|
||||
| | | | |
|
||||
| +-----+------+ +------+-----+
|
||||
| | |
|
||||
| +-------------+-------------+
|
||||
| | | |
|
||||
| +------v----+ +-----v-----+ +----v------+
|
||||
| | | | | | |
|
||||
| | worker-01 | | worker-02 | | worker-03 |
|
||||
| | | | | | |
|
||||
| +-----------+ +-----------+ +-----------+
|
||||
|
|
||||
| +-------+ +-------+
|
||||
| | | | |
|
||||
+-------------------> db-01 +--+ db-02 |
|
||||
| | | |
|
||||
+-------+ +-------+
|
||||
```
|
||||
|
||||
### Required Components
|
||||
|
||||
- Load balancer
|
||||
- 2 control plane nodes
|
||||
- 1 or more worker nodes
|
||||
- PostgreSQL Database (replicated, or Linux HA Cluster).
|
||||
|
||||
## Configuration
|
||||
|
||||
For your control nodes, you will need to instruct the control plane of the
|
||||
PostgreSQL datastore endpoint and set `k3s_registration_address` to be the
|
||||
hostname or IP of your load balancer or VIP.
|
||||
|
||||
Below is the example for PostgreSQL, it is possible to use MySQL or an Etcd
|
||||
cluster as well. Consult the below guide for using alternative datastore
|
||||
endpoints.
|
||||
|
||||
https://rancher.com/docs/k3s/latest/en/installation/datastore/#datastore-endpoint-format-and-functionality
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_server:
|
||||
datastore-endpoint: postgres://postgres:verybadpass@database:5432/postgres?sslmode=disable
|
||||
node-taint:
|
||||
- "k3s-controlplane=true:NoExecute"
|
||||
```
|
||||
|
||||
Your worker nodes need to know how to connect to the control plane, this is
|
||||
defined by setting `k3s_registration_address` to the hostname or IP address of
|
||||
the load balancer.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_registration_address: control.examplek3s.com
|
||||
```
|
|
@ -0,0 +1,21 @@
|
|||
# IPv4 and IPv6 Dual-stack config
|
||||
|
||||
If you need to run your K3S cluster with both IPv4 and IPv6 address ranges
|
||||
you will need to configure the `k3s_server.cluster-cidr` and
|
||||
`k3s_server.service-cidr` values specifying both ranges.
|
||||
|
||||
:hand: if you are using `k3s<1.23` you will need to use a different CNI as
|
||||
dual-stack support is not available in Flannel.
|
||||
|
||||
Below is a noddy example:
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_server:
|
||||
# Using Calico on k3s<1.23 so Flannel needs to be disabled.
|
||||
flannel-backend: 'none'
|
||||
# Format: ipv4/cidr,ipv6/cidr
|
||||
cluster-cidr: 10.42.0.0/16,fc00:a0::/64
|
||||
service-cidr: 10.43.0.0/16,fc00:a1::/64
|
||||
```
|
|
@ -0,0 +1,71 @@
|
|||
# Multiple standalone K3s nodes
|
||||
|
||||
This is an example of when you might want to configure multiple standalone
|
||||
k3s nodes simultaneously. For this we will assume a hypothetical situation
|
||||
where we are configuring 25 Raspberry Pis to deploy to our shop floors.
|
||||
|
||||
Each Rasperry Pi will be configured as a standalone IoT device hosting an
|
||||
application that will push data to head office.
|
||||
|
||||
## Architecture
|
||||
|
||||
```text
|
||||
+-------------+
|
||||
| |
|
||||
| Node-01 +-+
|
||||
| | |
|
||||
+--+----------+ +-+
|
||||
| | |
|
||||
+--+---------+ +-+
|
||||
| | |
|
||||
+--+--------+ |
|
||||
| | Node-N
|
||||
+----------+
|
||||
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
Below is our example inventory of 200 nodes (Truncated):
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_workers:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
# ..... SNIP .....
|
||||
|
||||
kube-199:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.201
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-200:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.202
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
```
|
||||
|
||||
In our `group_vars/` (or as `vars:` in our playbook), we will need to set the
|
||||
`k3s_build_cluster` variable to `false`. This will stop the role from
|
||||
attempting to cluster all 200 nodes, instead it will install k3s across each
|
||||
node as as 200 standalone servers.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_build_cluster: false
|
||||
```
|
|
@ -0,0 +1,39 @@
|
|||
# Configure node labels and component arguments
|
||||
|
||||
The following command line arguments can be specified multiple times with
|
||||
`key=value` pairs:
|
||||
|
||||
- `--kube-kubelet-arg`
|
||||
- `--kube-proxy-arg`
|
||||
- `--kube-apiserver-arg`
|
||||
- `--kube-scheduler-arg`
|
||||
- `--kube-controller-manager-arg`
|
||||
- `--kube-cloud-controller-manager-arg`
|
||||
- `--node-label`
|
||||
- `--node-taint`
|
||||
|
||||
In the config file, this is done by defining a list of values for each
|
||||
command like argument, for example:
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_server:
|
||||
# Set the plugins registry directory
|
||||
kubelet-arg:
|
||||
- "volume-plugin-dir=/var/lib/rancher/k3s/agent/kubelet/plugins_registry"
|
||||
# Set the pod eviction timeout and node monitor grace period
|
||||
kube-controller-manager-arg:
|
||||
- "pod-eviction-timeout=2m"
|
||||
- "node-monitor-grace-period=30s"
|
||||
# Set API server feature gate
|
||||
kube-apiserver-arg:
|
||||
- "feature-gates=RemoveSelfLink=false"
|
||||
# Laels to apply to a node
|
||||
node-label:
|
||||
- "NodeTier=development"
|
||||
- "NodeLocation=eu-west-2a"
|
||||
# Stop k3s control plane having workloads scheduled on them
|
||||
node-taint:
|
||||
- "k3s-controlplane=true:NoExecute"
|
||||
```
|
|
@ -0,0 +1,19 @@
|
|||
# systemd config
|
||||
|
||||
Below are examples to tweak how and when K3S starts up.
|
||||
|
||||
## Wanted service units
|
||||
|
||||
In this example, we're going to start K3S after Wireguard. Our example server
|
||||
has a Wireguard connection `wg0`. We are using "wants" rather than "requires"
|
||||
as it's a weaker requirement that Wireguard must be running. We then want
|
||||
K3S to start after Wireguard has started.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_service_wants:
|
||||
- wg-quick@wg0.service
|
||||
k3s_service_after:
|
||||
- wg-quick@wg0.service
|
||||
```
|
|
@ -0,0 +1,63 @@
|
|||
# Use an alternate CNI
|
||||
|
||||
K3S ships with Flannel, however sometimes you want an different CNI such as
|
||||
Calico, Canal or Weave Net. To do this you will need to disable Flannel with
|
||||
`flannel-backend: "none"`, specify a `cluster-cidr` and add your CNI manifests
|
||||
to the `k3s_server_manifests_templates`.
|
||||
|
||||
## Calico example
|
||||
|
||||
The below is based on the
|
||||
[Calico quickstart documentation](https://docs.projectcalico.org/getting-started/kubernetes/quickstart).
|
||||
|
||||
Steps:
|
||||
|
||||
1. Download `tigera-operator.yaml` to the manifests directory.
|
||||
1. Download `custom-resources.yaml` to the manifests directory.
|
||||
1. Choose a `cluster-cidr` (we are using 192.168.0.0/16)
|
||||
1. Set `k3s_server` and `k3s_server_manifest_templates` as per the below,
|
||||
ensure the paths to manifests are correct for your project repo.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
# K3S Server config, don't deploy flannel and set cluster pod CIDR.
|
||||
k3s_server:
|
||||
cluster-cidr: 192.168.0.0/16
|
||||
flannel-backend: "none"
|
||||
|
||||
# Deploy the following k3s server templates.
|
||||
k3s_server_manifests_templates:
|
||||
- "manifests/calico/tigera-operator.yaml"
|
||||
- "manifests/calico/custom-resources.yaml"
|
||||
```
|
||||
|
||||
All nodes should come up as "Ready", below is a 3-node cluster:
|
||||
|
||||
```text
|
||||
$ kubectl get nodes -o wide -w
|
||||
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
|
||||
kube-0 Ready control-plane,etcd,master 114s v1.20.2+k3s1 10.10.9.2 10.10.9.2 Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.3-k3s1
|
||||
kube-1 Ready control-plane,etcd,master 80s v1.20.2+k3s1 10.10.9.3 10.10.9.3 Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.3-k3s1
|
||||
kube-2 Ready control-plane,etcd,master 73s v1.20.2+k3s1 10.10.9.4 10.10.9.4 Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.3-k3s1
|
||||
```
|
||||
|
||||
Pods should be deployed with deployed within the CIDR specified in our config
|
||||
file.
|
||||
|
||||
```text
|
||||
$ kubectl get pods -o wide -A
|
||||
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
|
||||
calico-system calico-kube-controllers-cfb4ff54b-8rp8r 1/1 Running 0 5m4s 192.168.145.65 kube-0 <none> <none>
|
||||
calico-system calico-node-2cm2m 1/1 Running 0 5m4s 10.10.9.2 kube-0 <none> <none>
|
||||
calico-system calico-node-2s6lx 1/1 Running 0 4m42s 10.10.9.4 kube-2 <none> <none>
|
||||
calico-system calico-node-zwqjz 1/1 Running 0 4m49s 10.10.9.3 kube-1 <none> <none>
|
||||
calico-system calico-typha-7b6747d665-78swq 1/1 Running 0 3m5s 10.10.9.4 kube-2 <none> <none>
|
||||
calico-system calico-typha-7b6747d665-8ff66 1/1 Running 0 3m5s 10.10.9.3 kube-1 <none> <none>
|
||||
calico-system calico-typha-7b6747d665-hgplx 1/1 Running 0 5m5s 10.10.9.2 kube-0 <none> <none>
|
||||
kube-system coredns-854c77959c-6qhgt 1/1 Running 0 5m20s 192.168.145.66 kube-0 <none> <none>
|
||||
kube-system helm-install-traefik-4czr9 0/1 Completed 0 5m20s 192.168.145.67 kube-0 <none> <none>
|
||||
kube-system metrics-server-86cbb8457f-qcxf5 1/1 Running 0 5m20s 192.168.145.68 kube-0 <none> <none>
|
||||
kube-system traefik-6f9cbd9bd4-7h4rl 1/1 Running 0 2m50s 192.168.126.65 kube-1 <none> <none>
|
||||
tigera-operator tigera-operator-b6c4bfdd9-29hhr 1/1 Running 0 5m20s 10.10.9.2 kube-0 <none> <none>
|
||||
```
|
|
@ -0,0 +1,69 @@
|
|||
# Extending a cluster
|
||||
|
||||
This document describes the method for extending an cluster with new worker
|
||||
nodes.
|
||||
|
||||
## Assumptions
|
||||
|
||||
It is assumed that you have already deployed a k3s cluster using this role,
|
||||
you have an appropriately configured inventory and playbook to create the
|
||||
cluster.
|
||||
|
||||
Below, our example inventory and playbook are as follows:
|
||||
|
||||
- inventory: `inventory.yml`
|
||||
- playbook: `cluster.yml`
|
||||
|
||||
Currently your `inventory.yml` looks like this, it has two nodes defined,
|
||||
`kube-0` (control node) and `kube-1` (worker node).
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
```
|
||||
|
||||
## Method
|
||||
|
||||
We have our two nodes, one control, one worker. The goal is to extend this to
|
||||
add capacity by adding a new worker node, `kube-2`. To do this we will add the
|
||||
new node to our inventory.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
```
|
||||
|
||||
Once the new node has been added, you can re-run the automation to join it to
|
||||
the cluster. You should expect the majority of changes to the worker node being
|
||||
introduced to the cluster.
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=53 changed=1 unreachable=0 failed=0 skipped=30 rescued=0 ignored=0
|
||||
kube-1 : ok=40 changed=1 unreachable=0 failed=0 skipped=35 rescued=0 ignored=0
|
||||
kube-2 : ok=42 changed=10 unreachable=0 failed=0 skipped=35 rescued=0 ignored=0
|
||||
```
|
|
@ -0,0 +1,74 @@
|
|||
# Shrinking a cluster
|
||||
|
||||
This document describes the method for shrinking a cluster, by removing a
|
||||
worker nodes.
|
||||
|
||||
## Assumptions
|
||||
|
||||
It is assumed that you have already deployed a k3s cluster using this role,
|
||||
you have an appropriately configured inventory and playbook to create the
|
||||
cluster.
|
||||
|
||||
Below, our example inventory and playbook are as follows:
|
||||
|
||||
- inventory: `inventory.yml`
|
||||
- playbook: `cluster.yml`
|
||||
|
||||
Currently your `inventory.yml` looks like this, it has three nodes defined,
|
||||
`kube-0` (control node) and `kube-1`, `kube-2` (worker nodes).
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
```
|
||||
|
||||
## Method
|
||||
|
||||
We have our three nodes, one control, two workers. The goal is to shrink this to
|
||||
remove excess capacity by offboarding the worker node `kube-2`. To do this we
|
||||
will set `kube-2` node to `k3s_state: uninstalled` in our inventory.
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
k3s_state: uninstalled
|
||||
```
|
||||
|
||||
What you will typically see is changes to your control plane (`kube-0`) and the
|
||||
node being removed (`kube-2`). The role will register the removal of the node
|
||||
with the cluster by draining the node and removing it from the cluster.
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=55 changed=2 unreachable=0 failed=0 skipped=28 rescued=0 ignored=0
|
||||
kube-1 : ok=40 changed=0 unreachable=0 failed=0 skipped=35 rescued=0 ignored=0
|
||||
kube-2 : ok=23 changed=2 unreachable=0 failed=0 skipped=17 rescued=0 ignored=1
|
||||
```
|
|
@ -0,0 +1,93 @@
|
|||
# Stopping and Starting a cluster
|
||||
|
||||
This document describes the Ansible method for restarting a k3s cluster
|
||||
deployed by this role.
|
||||
|
||||
## Assumptions
|
||||
|
||||
It is assumed that you have already deployed a k3s cluster using this role,
|
||||
you have an appropriately configured inventory and playbook to create the
|
||||
cluster.
|
||||
|
||||
Below, our example inventory and playbook are as follows:
|
||||
|
||||
- inventory: `inventory.yml`
|
||||
- playbook: `cluster.yml`
|
||||
|
||||
## Method
|
||||
|
||||
### Start cluster
|
||||
|
||||
You can start the cluster using either of the following commands:
|
||||
|
||||
- Using the playbook: `ansible-playbook -i inventory.yml cluster.yml --become -e 'k3s_state=started'`
|
||||
- Using an ad-hoc command: `ansible -i inventory.yml -m service -a 'name=k3s state=started' --become all`
|
||||
|
||||
Below is example output, remember that Ansible is idempotent so re-running a
|
||||
command may not necessarily change the state.
|
||||
|
||||
**Playbook method output**:
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=6 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
|
||||
kube-1 : ok=6 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
|
||||
kube-2 : ok=6 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
### Stop cluster
|
||||
|
||||
You can stop the cluster using either of the following commands:
|
||||
|
||||
- Using the playbook: `ansible-playbook -i inventory.yml cluster.yml --become -e 'k3s_state=stopped'`
|
||||
- Using an ad-hoc command: `ansible -i inventory.yml -m service -a 'name=k3s state=stopped' --become all`
|
||||
|
||||
Below is example output, remember that Ansible is idempotent so re-running a
|
||||
command may not necessarily change the state.
|
||||
|
||||
**Playbook method output**:
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=6 changed=1 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
|
||||
kube-1 : ok=6 changed=1 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
|
||||
kube-2 : ok=6 changed=1 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
### Restart cluster
|
||||
|
||||
Just like the `service` module, you can also specify `restarted` as a state.
|
||||
This will do `stop` followed by `start`.
|
||||
|
||||
- Using the playbook: `ansible-playbook -i inventory.yml cluster.yml --become -e 'k3s_state=restarted'`
|
||||
- Using an ad-hoc command: `ansible -i inventory.yml -m service -a 'name=k3s state=restarted' --become all`
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=7 changed=1 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0
|
||||
kube-1 : ok=7 changed=1 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0
|
||||
kube-2 : ok=7 changed=1 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
## Tips
|
||||
|
||||
You can limit the targets by adding the `-l` flag to your `ansible-playbook`
|
||||
command, or simply target your ad-hoc commands. For example, in a 3 node
|
||||
cluster (called `kube-0`, `kube-1` and `kube-2`) we can limit the restart to
|
||||
`kube-1` and `kube-2` with the following:
|
||||
|
||||
- Using the playbook: `ansible-playbook -i inventory.yml cluster.yml --become -e 'k3s_state=restarted' -l "kube-1,kube-2"`
|
||||
- Using an ad-hoc command: `ansible -i inventory.yml -m service -a 'name=k3s state=restarted' --become "kube-1,kube-2"`
|
||||
|
||||
```text
|
||||
PLAY RECAP ********************************************************************************************************
|
||||
kube-1 : ok=7 changed=2 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0
|
||||
kube-2 : ok=7 changed=2 unreachable=0 failed=0 skipped=3 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
## FAQ
|
||||
|
||||
1. _Why might I use the `ansible-playbook` command over an ad-hoc command?_
|
||||
- The stop/start tasks will be aware of configuration. As the role
|
||||
develops, there might be some pre-tasks added to change how a cluster
|
||||
is stopped or started.
|
|
@ -0,0 +1,52 @@
|
|||
# Updating k3s
|
||||
|
||||
## Before you start!
|
||||
|
||||
Ensure you back up your k3s cluster. This is particularly important if you use
|
||||
an external datastore or embedded Etcd. Please refer to the below guide to
|
||||
backing up your k3s datastore:
|
||||
|
||||
https://rancher.com/docs/k3s/latest/en/backup-restore/
|
||||
|
||||
Also, check your volume backups are also working!
|
||||
|
||||
## Proceedure
|
||||
|
||||
### Updates using Ansible
|
||||
|
||||
To update via Ansible, set `k3s_release_version` to the target version you wish
|
||||
to go to. For example, from your `v1.19.3+k3s1` playbook:
|
||||
|
||||
```yaml
|
||||
---
|
||||
# BEFORE
|
||||
|
||||
- name: Provision k3s cluster
|
||||
hosts: k3s_cluster
|
||||
vars:
|
||||
k3s_release_version: v1.19.3+k3s1
|
||||
roles:
|
||||
- name: xanmanning.k3s
|
||||
```
|
||||
|
||||
Updating to `v1.20.2+k3s1`:
|
||||
|
||||
```yaml
|
||||
---
|
||||
# AFTER
|
||||
|
||||
- name: Provision k3s cluster
|
||||
hosts: k3s_cluster
|
||||
vars:
|
||||
k3s_release_version: v1.20.2+k3s1
|
||||
roles:
|
||||
- name: xanmanning.k3s
|
||||
```
|
||||
|
||||
### Automatic updates
|
||||
|
||||
For automatic updates, consider installing Rancher's
|
||||
[system-upgrade-controller](https://rancher.com/docs/k3s/latest/en/upgrades/automated/)
|
||||
|
||||
**Please note**, to be able to update using the system-upgrade-controller you
|
||||
will need to set `k3s_install_hard_links` to `true`.
|
147
roles/xanmanning.k3s/documentation/quickstart-cluster.md
Normal file
147
roles/xanmanning.k3s/documentation/quickstart-cluster.md
Normal file
|
@ -0,0 +1,147 @@
|
|||
# Quickstart: K3s cluster with a single control node
|
||||
|
||||
This is the quickstart guide to creating your own k3s cluster with one control
|
||||
plane node. This control plane node will also be a worker.
|
||||
|
||||
:hand: This example requires your Ansible user to be able to connect to the
|
||||
servers over SSH using key-based authentication. The user is also has an entry
|
||||
in a sudoers file that allows privilege escalation without requiring a
|
||||
password.
|
||||
|
||||
To test this is the case, run the following check replacing `<ansible_user>`
|
||||
and `<server_name>`. The expected output is `Works`
|
||||
|
||||
`ssh <ansible_user>@<server_name> 'sudo cat /etc/shadow >/dev/null && echo "Works"'`
|
||||
|
||||
For example:
|
||||
|
||||
```text
|
||||
[ xmanning@dreadfort:~/git/kubernetes-playground ] (master) $ ssh ansible@kube-0 'sudo cat /etc/shadow >/dev/null && echo "Works"'
|
||||
Works
|
||||
[ xmanning@dreadfort:~/git/kubernetes-playground ] (master) $
|
||||
```
|
||||
|
||||
## Directory structure
|
||||
|
||||
Our working directory will have the following files:
|
||||
|
||||
```text
|
||||
kubernetes-playground/
|
||||
|_ inventory.yml
|
||||
|_ cluster.yml
|
||||
```
|
||||
|
||||
## Inventory
|
||||
|
||||
Here's a YAML based example inventory for our servers called `inventory.yml`:
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
```
|
||||
|
||||
We can test this works with `ansible -i inventory.yml -m ping all`, expected
|
||||
result:
|
||||
|
||||
```text
|
||||
kube-0 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
kube-1 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
kube-2 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
## Playbook
|
||||
|
||||
Here is our playbook for the k3s cluster (`cluster.yml`):
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
- name: Build a cluster with a single control node
|
||||
hosts: k3s_cluster
|
||||
vars:
|
||||
k3s_become: true
|
||||
roles:
|
||||
- role: xanmanning.k3s
|
||||
```
|
||||
|
||||
## Execution
|
||||
|
||||
To execute the playbook against our inventory file, we will run the following
|
||||
command:
|
||||
|
||||
`ansible-playbook -i inventory.yml cluster.yml`
|
||||
|
||||
The output we can expect is similar to the below, with no failed or unreachable
|
||||
nodes. The default behavior of this role is to delegate the first play host as
|
||||
the control node, so kube-0 will have more changed tasks than others:
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=56 changed=11 unreachable=0 failed=0 skipped=28 rescued=0 ignored=0
|
||||
kube-1 : ok=43 changed=10 unreachable=0 failed=0 skipped=32 rescued=0 ignored=0
|
||||
kube-2 : ok=43 changed=10 unreachable=0 failed=0 skipped=32 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
After logging into kube-0, we can test that k3s is running across the cluster,
|
||||
that all nodes are ready and that everything is ready to execute our Kubernetes
|
||||
workloads by running the following:
|
||||
|
||||
- `sudo kubectl get nodes -o wide`
|
||||
- `sudo kubectl get pods -o wide --all-namespaces`
|
||||
|
||||
:hand: Note we are using `sudo` because we need to be root to access the
|
||||
kube config for this node. This behavior can be changed with specifying
|
||||
`write-kubeconfig-mode: '0644'` in `k3s_server`.
|
||||
|
||||
**Get Nodes**:
|
||||
|
||||
```text
|
||||
ansible@kube-0:~$ sudo kubectl get nodes -o wide
|
||||
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
|
||||
kube-0 Ready master 34s v1.19.4+k3s1 10.0.2.15 <none> Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.1-k3s1
|
||||
kube-2 Ready <none> 14s v1.19.4+k3s1 10.0.2.17 <none> Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.1-k3s1
|
||||
kube-1 Ready <none> 14s v1.19.4+k3s1 10.0.2.16 <none> Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.1-k3s1
|
||||
ansible@kube-0:~$
|
||||
```
|
||||
|
||||
**Get Pods**:
|
||||
|
||||
```text
|
||||
ansible@kube-0:~$ sudo kubectl get pods -o wide --all-namespaces
|
||||
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
|
||||
kube-system local-path-provisioner-7ff9579c6-72j8x 1/1 Running 0 55s 10.42.2.2 kube-1 <none> <none>
|
||||
kube-system metrics-server-7b4f8b595-lkspj 1/1 Running 0 55s 10.42.1.2 kube-2 <none> <none>
|
||||
kube-system helm-install-traefik-b6vnt 0/1 Completed 0 55s 10.42.0.3 kube-0 <none> <none>
|
||||
kube-system coredns-66c464876b-llsh7 1/1 Running 0 55s 10.42.0.2 kube-0 <none> <none>
|
||||
kube-system svclb-traefik-jrqg7 2/2 Running 0 27s 10.42.1.3 kube-2 <none> <none>
|
||||
kube-system svclb-traefik-gh65q 2/2 Running 0 27s 10.42.0.4 kube-0 <none> <none>
|
||||
kube-system svclb-traefik-5z7zp 2/2 Running 0 27s 10.42.2.3 kube-1 <none> <none>
|
||||
kube-system traefik-5dd496474-l2k74 1/1 Running 0 27s 10.42.1.4 kube-2 <none> <none>
|
||||
```
|
154
roles/xanmanning.k3s/documentation/quickstart-ha-cluster.md
Normal file
154
roles/xanmanning.k3s/documentation/quickstart-ha-cluster.md
Normal file
|
@ -0,0 +1,154 @@
|
|||
# Quickstart: K3s cluster with a HA control plane using embedded etcd
|
||||
|
||||
This is the quickstart guide to creating your own 3 node k3s cluster with a
|
||||
highly available control plane using the embedded etcd datastore.
|
||||
The control plane will all be workers as well.
|
||||
|
||||
:hand: This example requires your Ansible user to be able to connect to the
|
||||
servers over SSH using key-based authentication. The user is also has an entry
|
||||
in a sudoers file that allows privilege escalation without requiring a
|
||||
password.
|
||||
|
||||
To test this is the case, run the following check replacing `<ansible_user>`
|
||||
and `<server_name>`. The expected output is `Works`
|
||||
|
||||
`ssh <ansible_user>@<server_name> 'sudo cat /etc/shadow >/dev/null && echo "Works"'`
|
||||
|
||||
For example:
|
||||
|
||||
```text
|
||||
[ xmanning@dreadfort:~/git/kubernetes-playground ] (master) $ ssh ansible@kube-0 'sudo cat /etc/shadow >/dev/null && echo "Works"'
|
||||
Works
|
||||
[ xmanning@dreadfort:~/git/kubernetes-playground ] (master) $
|
||||
```
|
||||
|
||||
## Directory structure
|
||||
|
||||
Our working directory will have the following files:
|
||||
|
||||
```text
|
||||
kubernetes-playground/
|
||||
|_ inventory.yml
|
||||
|_ ha_cluster.yml
|
||||
```
|
||||
|
||||
## Inventory
|
||||
|
||||
Here's a YAML based example inventory for our servers called `inventory.yml`:
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
# We're adding k3s_control_node to each host, this can be done in host_vars/
|
||||
# or group_vars/ as well - but for simplicity we are setting it here.
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
k3s_control_node: true
|
||||
kube-1:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.3
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
k3s_control_node: true
|
||||
kube-2:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.4
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
k3s_control_node: true
|
||||
|
||||
```
|
||||
|
||||
We can test this works with `ansible -i inventory.yml -m ping all`, expected
|
||||
result:
|
||||
|
||||
```text
|
||||
kube-0 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
kube-1 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
kube-2 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
## Playbook
|
||||
|
||||
Here is our playbook for the k3s cluster (`ha_cluster.yml`):
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
- name: Build a cluster with HA control plane
|
||||
hosts: k3s_cluster
|
||||
vars:
|
||||
k3s_become: true
|
||||
k3s_etcd_datastore: true
|
||||
k3s_use_experimental: true # Note this is required for k3s < v1.19.5+k3s1
|
||||
roles:
|
||||
- role: xanmanning.k3s
|
||||
```
|
||||
|
||||
## Execution
|
||||
|
||||
To execute the playbook against our inventory file, we will run the following
|
||||
command:
|
||||
|
||||
`ansible-playbook -i inventory.yml ha_cluster.yml`
|
||||
|
||||
The output we can expect is similar to the below, with no failed or unreachable
|
||||
nodes. The default behavior of this role is to delegate the first play host as
|
||||
the primary control node, so kube-0 will have more changed tasks than others:
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=53 changed=8 unreachable=0 failed=0 skipped=30 rescued=0 ignored=0
|
||||
kube-1 : ok=47 changed=10 unreachable=0 failed=0 skipped=28 rescued=0 ignored=0
|
||||
kube-2 : ok=47 changed=9 unreachable=0 failed=0 skipped=28 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
After logging into any of the servers (it doesn't matter), we can test that k3s
|
||||
is running across the cluster, that all nodes are ready and that everything is
|
||||
ready to execute our Kubernetes workloads by running the following:
|
||||
|
||||
- `sudo kubectl get nodes -o wide`
|
||||
- `sudo kubectl get pods -o wide --all-namespaces`
|
||||
|
||||
:hand: Note we are using `sudo` because we need to be root to access the
|
||||
kube config for this node. This behavior can be changed with specifying
|
||||
`write-kubeconfig-mode: '0644'` in `k3s_server`.
|
||||
|
||||
**Get Nodes**:
|
||||
|
||||
```text
|
||||
ansible@kube-0:~$ sudo kubectl get nodes -o wide
|
||||
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
|
||||
kube-0 Ready etcd,master 2m58s v1.19.4+k3s1 10.10.9.2 10.10.9.2 Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.1-k3s1
|
||||
kube-1 Ready etcd,master 2m22s v1.19.4+k3s1 10.10.9.3 10.10.9.3 Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.1-k3s1
|
||||
kube-2 Ready etcd,master 2m10s v1.19.4+k3s1 10.10.9.4 10.10.9.4 Ubuntu 20.04.1 LTS 5.4.0-56-generic containerd://1.4.1-k3s1
|
||||
```
|
||||
|
||||
**Get Pods**:
|
||||
|
||||
```text
|
||||
ansible@kube-0:~$ sudo kubectl get pods -o wide --all-namespaces
|
||||
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
|
||||
kube-system coredns-66c464876b-rhgn6 1/1 Running 0 3m38s 10.42.0.2 kube-0 <none> <none>
|
||||
kube-system helm-install-traefik-vwglv 0/1 Completed 0 3m39s 10.42.0.3 kube-0 <none> <none>
|
||||
kube-system local-path-provisioner-7ff9579c6-d5xpb 1/1 Running 0 3m38s 10.42.0.5 kube-0 <none> <none>
|
||||
kube-system metrics-server-7b4f8b595-nhbt8 1/1 Running 0 3m38s 10.42.0.4 kube-0 <none> <none>
|
||||
kube-system svclb-traefik-9lzcq 2/2 Running 0 2m56s 10.42.1.2 kube-1 <none> <none>
|
||||
kube-system svclb-traefik-vq487 2/2 Running 0 2m45s 10.42.2.2 kube-2 <none> <none>
|
||||
kube-system svclb-traefik-wkwkk 2/2 Running 0 3m1s 10.42.0.7 kube-0 <none> <none>
|
||||
kube-system traefik-5dd496474-lw6x8 1/1 Running 0 3m1s 10.42.0.6 kube-0 <none> <none>
|
||||
```
|
121
roles/xanmanning.k3s/documentation/quickstart-single-node.md
Normal file
121
roles/xanmanning.k3s/documentation/quickstart-single-node.md
Normal file
|
@ -0,0 +1,121 @@
|
|||
# Quickstart: K3s single node
|
||||
|
||||
This is the quickstart guide to creating your own single-node k3s "cluster".
|
||||
|
||||
:hand: This example requires your Ansible user to be able to connect to the
|
||||
server over SSH using key-based authentication. The user is also has an entry
|
||||
in a sudoers file that allows privilege escalation without requiring a
|
||||
password.
|
||||
|
||||
To test this is the case, run the following check replacing `<ansible_user>`
|
||||
and `<server_name>`. The expected output is `Works`
|
||||
|
||||
`ssh <ansible_user>@<server_name> 'sudo cat /etc/shadow >/dev/null && echo "Works"'`
|
||||
|
||||
For example:
|
||||
|
||||
```text
|
||||
[ xmanning@dreadfort:~/git/kubernetes-playground ] (master) $ ssh ansible@kube-0 'sudo cat /etc/shadow >/dev/null && echo "Works"'
|
||||
Works
|
||||
[ xmanning@dreadfort:~/git/kubernetes-playground ] (master) $
|
||||
```
|
||||
|
||||
## Directory structure
|
||||
|
||||
Our working directory will have the following files:
|
||||
|
||||
```text
|
||||
kubernetes-playground/
|
||||
|_ inventory.yml
|
||||
|_ single_node.yml
|
||||
```
|
||||
|
||||
## Inventory
|
||||
|
||||
Here's a YAML based example inventory for our server called `inventory.yml`:
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
k3s_cluster:
|
||||
hosts:
|
||||
kube-0:
|
||||
ansible_user: ansible
|
||||
ansible_host: 10.10.9.2
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
```
|
||||
|
||||
We can test this works with `ansible -i inventory.yml -m ping all`, expected
|
||||
result:
|
||||
|
||||
```text
|
||||
kube-0 | SUCCESS => {
|
||||
"changed": false,
|
||||
"ping": "pong"
|
||||
}
|
||||
```
|
||||
|
||||
## Playbook
|
||||
|
||||
Here is our playbook for a single node k3s cluster (`single_node.yml`):
|
||||
|
||||
```yaml
|
||||
---
|
||||
|
||||
- name: Build a single node k3s cluster
|
||||
hosts: kube-0
|
||||
vars:
|
||||
k3s_become: true
|
||||
roles:
|
||||
- role: xanmanning.k3s
|
||||
```
|
||||
|
||||
## Execution
|
||||
|
||||
To execute the playbook against our inventory file, we will run the following
|
||||
command:
|
||||
|
||||
`ansible-playbook -i inventory.yml single_node.yml`
|
||||
|
||||
The output we can expect is similar to the below, with no failed or unreachable
|
||||
nodes:
|
||||
|
||||
```text
|
||||
PLAY RECAP *******************************************************************************************************
|
||||
kube-0 : ok=39 changed=8 unreachable=0 failed=0 skipped=39 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
## Testing
|
||||
|
||||
After logging into the server, we can test that k3s is running and that it is
|
||||
ready to execute our Kubernetes workloads by running the following:
|
||||
|
||||
- `sudo kubectl get nodes`
|
||||
- `sudo kubectl get pods -o wide --all-namespaces`
|
||||
|
||||
:hand: Note we are using `sudo` because we need to be root to access the
|
||||
kube config for this node. This behavior can be changed with specifying
|
||||
`write-kubeconfig-mode: '0644'` in `k3s_server`.
|
||||
|
||||
**Get Nodes**:
|
||||
|
||||
```text
|
||||
ansible@kube-0:~$ sudo kubectl get nodes
|
||||
NAME STATUS ROLES AGE VERSION
|
||||
kube-0 Ready master 5m27s v1.19.4+k3s
|
||||
ansible@kube-0:~$
|
||||
```
|
||||
|
||||
**Get Pods**:
|
||||
|
||||
```text
|
||||
ansible@kube-0:~$ sudo kubectl get pods --all-namespaces -o wide
|
||||
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
|
||||
kube-system metrics-server-7b4f8b595-k692h 1/1 Running 0 9m38s 10.42.0.2 kube-0 <none> <none>
|
||||
kube-system local-path-provisioner-7ff9579c6-5lgzb 1/1 Running 0 9m38s 10.42.0.3 kube-0 <none> <none>
|
||||
kube-system coredns-66c464876b-xg42q 1/1 Running 0 9m38s 10.42.0.5 kube-0 <none> <none>
|
||||
kube-system helm-install-traefik-tdpcs 0/1 Completed 0 9m38s 10.42.0.4 kube-0 <none> <none>
|
||||
kube-system svclb-traefik-hk248 2/2 Running 0 9m4s 10.42.0.7 kube-0 <none> <none>
|
||||
kube-system traefik-5dd496474-bf4kv 1/1 Running 0 9m4s 10.42.0.6 kube-0 <none> <none>
|
||||
```
|
39
roles/xanmanning.k3s/handlers/main.yml
Normal file
39
roles/xanmanning.k3s/handlers/main.yml
Normal file
|
@ -0,0 +1,39 @@
|
|||
---
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
scope: "{{ k3s_systemd_context }}"
|
||||
become: "{{ k3s_become }}"
|
||||
|
||||
- name: Reload service
|
||||
ansible.builtin.set_fact:
|
||||
k3s_service_reloaded: true
|
||||
become: "{{ k3s_become }}"
|
||||
|
||||
- name: Restart k3s systemd
|
||||
ansible.builtin.systemd:
|
||||
name: k3s
|
||||
state: restarted
|
||||
scope: "{{ k3s_systemd_context }}"
|
||||
enabled: "{{ k3s_start_on_boot }}"
|
||||
retries: 3
|
||||
delay: 3
|
||||
register: k3s_systemd_restart_k3s
|
||||
failed_when:
|
||||
- k3s_systemd_restart_k3s is not success
|
||||
- not ansible_check_mode
|
||||
become: "{{ k3s_become }}"
|
||||
|
||||
- name: Restart k3s service
|
||||
ansible.builtin.service:
|
||||
name: k3s
|
||||
state: restarted
|
||||
enabled: "{{ k3s_start_on_boot }}"
|
||||
retries: 3
|
||||
delay: 3
|
||||
register: k3s_service_restart_k3s
|
||||
failed_when:
|
||||
- k3s_service_restart_k3s is not success
|
||||
- not ansible_check_mode
|
||||
become: "{{ k3s_become }}"
|
86
roles/xanmanning.k3s/meta/main.yml
Normal file
86
roles/xanmanning.k3s/meta/main.yml
Normal file
|
@ -0,0 +1,86 @@
|
|||
---
|
||||
|
||||
galaxy_info:
|
||||
role_name: k3s
|
||||
namespace: xanmanning
|
||||
author: Xan Manning
|
||||
description: Ansible role for installing k3s as either a standalone server or HA cluster
|
||||
company: Pyrat Ltd.
|
||||
github_branch: main
|
||||
|
||||
# If the issue tracker for your role is not on github, uncomment the
|
||||
# next line and provide a value
|
||||
# issue_tracker_url: http://example.com/issue/tracker
|
||||
|
||||
# Some suggested licenses:
|
||||
# - BSD (default)
|
||||
# - MIT
|
||||
# - GPLv2
|
||||
# - GPLv3
|
||||
# - Apache
|
||||
# - CC-BY
|
||||
license: BSD
|
||||
|
||||
min_ansible_version: '2.9'
|
||||
|
||||
# If this a Container Enabled role, provide the minimum Ansible Container version.
|
||||
# min_ansible_container_version:
|
||||
|
||||
# Optionally specify the branch Galaxy will use when accessing the GitHub
|
||||
# repo for this role. During role install, if no tags are available,
|
||||
# Galaxy will use this branch. During import Galaxy will access files on
|
||||
# this branch. If Travis integration is configured, only notifications for this
|
||||
# branch will be accepted. Otherwise, in all cases, the repo's default branch
|
||||
# (usually main) will be used.
|
||||
# github_branch:
|
||||
|
||||
#
|
||||
# platforms is a list of platforms, and each platform has a name and a list of versions.
|
||||
#
|
||||
platforms:
|
||||
- name: Alpine
|
||||
versions:
|
||||
- all
|
||||
- name: Archlinux
|
||||
versions:
|
||||
- all
|
||||
- name: EL
|
||||
versions:
|
||||
- 7
|
||||
- 8
|
||||
- name: Amazon
|
||||
- name: Fedora
|
||||
versions:
|
||||
- 29
|
||||
- 30
|
||||
- 31
|
||||
- name: Debian
|
||||
versions:
|
||||
- buster
|
||||
- jessie
|
||||
- stretch
|
||||
- name: SLES
|
||||
versions:
|
||||
- 15
|
||||
- name: Ubuntu
|
||||
versions:
|
||||
- xenial
|
||||
- bionic
|
||||
|
||||
galaxy_tags:
|
||||
- k3s
|
||||
- k8s
|
||||
- kubernetes
|
||||
- containerd
|
||||
- cluster
|
||||
- lightweight
|
||||
# List tags for your role here, one per line. A tag is a keyword that describes
|
||||
# and categorizes the role. Users find roles by searching for tags. Be sure to
|
||||
# remove the '[]' above, if you add tags to this list.
|
||||
#
|
||||
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
|
||||
# Maximum 20 tags per role.
|
||||
|
||||
dependencies: []
|
||||
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
|
||||
# if you add dependencies to this list.
|
28
roles/xanmanning.k3s/molecule/autodeploy/converge.yml
Normal file
28
roles/xanmanning.k3s/molecule/autodeploy/converge.yml
Normal file
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
- name: Converge
|
||||
hosts: node*
|
||||
become: true
|
||||
vars:
|
||||
molecule_is_test: true
|
||||
k3s_release_version: v1.22
|
||||
k3s_build_cluster: false
|
||||
k3s_control_token: 55ba04e5-e17d-4535-9170-3e4245453f4d
|
||||
k3s_install_dir: /opt/k3s/bin
|
||||
k3s_config_file: /opt/k3s/etc/k3s_config.yaml
|
||||
k3s_server:
|
||||
data-dir: /var/lib/k3s-io
|
||||
default-local-storage-path: /var/lib/k3s-io/local-storage
|
||||
disable:
|
||||
- metrics-server
|
||||
- traefik
|
||||
# k3s_agent:
|
||||
# snapshotter: native
|
||||
k3s_server_manifests_templates:
|
||||
- "molecule/autodeploy/templates/00-ns-monitoring.yml.j2"
|
||||
k3s_server_manifests_urls:
|
||||
- url: https://raw.githubusercontent.com/metallb/metallb/v0.9.6/manifests/namespace.yaml
|
||||
filename: 05-metallb-namespace.yml
|
||||
k3s_service_env_vars:
|
||||
K3S_TEST_VAR: "Hello world!"
|
||||
roles:
|
||||
- role: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
|
60
roles/xanmanning.k3s/molecule/autodeploy/molecule.yml
Normal file
60
roles/xanmanning.k3s/molecule/autodeploy/molecule.yml
Normal file
|
@ -0,0 +1,60 @@
|
|||
---
|
||||
|
||||
dependency:
|
||||
name: galaxy
|
||||
driver:
|
||||
name: docker
|
||||
scenario:
|
||||
test_sequence:
|
||||
- dependency
|
||||
- lint
|
||||
- cleanup
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- side_effect
|
||||
- verify
|
||||
- cleanup
|
||||
- destroy
|
||||
lint: |
|
||||
set -e
|
||||
yamllint -s .
|
||||
ansible-lint --exclude molecule/ --exclude meta/
|
||||
platforms:
|
||||
- name: node1
|
||||
image: ${MOLECULE_DISTRO:-"geerlingguy/docker-rockylinux8-ansible:latest"}
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: ${MOLECULE_PREBUILT:-true}
|
||||
networks:
|
||||
- name: k3snet
|
||||
- name: node2
|
||||
image: ${MOLECULE_DISTRO:-"geerlingguy/docker-rockylinux8-ansible:latest"}
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: ${MOLECULE_PREBUILT:-true}
|
||||
networks:
|
||||
- name: k3snet
|
||||
- name: node3
|
||||
image: ${MOLECULE_DISTRO:-"geerlingguy/docker-rockylinux8-ansible:latest"}
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: ${MOLECULE_PREBUILT:-true}
|
||||
networks:
|
||||
- name: k3snet
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
verbose: true
|
||||
verifier:
|
||||
name: ansible
|
26
roles/xanmanning.k3s/molecule/autodeploy/prepare.yml
Normal file
26
roles/xanmanning.k3s/molecule/autodeploy/prepare.yml
Normal file
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
- name: Prepare
|
||||
hosts: node*
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure apt cache is updated and iptables is installed
|
||||
ansible.builtin.apt:
|
||||
name: iptables
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_pkg_mgr == 'apt'
|
||||
|
||||
- name: Ensure install directory and configuration directory exists
|
||||
ansible.builtin.file:
|
||||
path: "/opt/k3s/{{ item }}"
|
||||
state: directory
|
||||
mode: 0755
|
||||
loop:
|
||||
- bin
|
||||
- etc
|
||||
|
||||
- name: Ensure data directory exists
|
||||
ansible.builtin.file:
|
||||
path: "/var/lib/k3s-io"
|
||||
state: directory
|
||||
mode: 0755
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: monitoring
|
9
roles/xanmanning.k3s/molecule/autodeploy/verify.yml
Normal file
9
roles/xanmanning.k3s/molecule/autodeploy/verify.yml
Normal file
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
# This is an example playbook to execute Ansible tests.
|
||||
|
||||
- name: Verify
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Example assertion
|
||||
ansible.builtin.assert:
|
||||
that: true
|
14
roles/xanmanning.k3s/molecule/debug/converge.yml
Normal file
14
roles/xanmanning.k3s/molecule/debug/converge.yml
Normal file
|
@ -0,0 +1,14 @@
|
|||
---
|
||||
- name: Converge
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
pyratlabs_issue_controller_dump: true
|
||||
k3s_agent:
|
||||
snapshotter: native
|
||||
pre_tasks:
|
||||
- name: Ensure k3s_debug is set
|
||||
ansible.builtin.set_fact:
|
||||
k3s_debug: true
|
||||
roles:
|
||||
- xanmanning.k3s
|
60
roles/xanmanning.k3s/molecule/debug/molecule.yml
Normal file
60
roles/xanmanning.k3s/molecule/debug/molecule.yml
Normal file
|
@ -0,0 +1,60 @@
|
|||
---
|
||||
|
||||
dependency:
|
||||
name: galaxy
|
||||
driver:
|
||||
name: docker
|
||||
scenario:
|
||||
test_sequence:
|
||||
- dependency
|
||||
- lint
|
||||
- cleanup
|
||||
- destroy
|
||||
- syntax
|
||||
- create
|
||||
- prepare
|
||||
- check
|
||||
- converge
|
||||
- idempotence
|
||||
- side_effect
|
||||
- verify
|
||||
- cleanup
|
||||
- destroy
|
||||
lint: |
|
||||
set -e
|
||||
yamllint -s .
|
||||
ansible-lint --exclude molecule/ --exclude meta/
|
||||
platforms:
|
||||
- name: node1
|
||||
image: ${MOLECULE_DISTRO:-"geerlingguy/docker-rockylinux8-ansible:latest"}
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: ${MOLECULE_PREBUILT:-true}
|
||||
networks:
|
||||
- name: k3snet
|
||||
- name: node2
|
||||
image: ${MOLECULE_DISTRO:-"geerlingguy/docker-rockylinux8-ansible:latest"}
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: ${MOLECULE_PREBUILT:-true}
|
||||
networks:
|
||||
- name: k3snet
|
||||
- name: node3
|
||||
image: ${MOLECULE_DISTRO:-"geerlingguy/docker-rockylinux8-ansible:latest"}
|
||||
command: ${MOLECULE_DOCKER_COMMAND:-""}
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
privileged: true
|
||||
pre_build_image: ${MOLECULE_PREBUILT:-true}
|
||||
networks:
|
||||
- name: k3snet
|
||||
provisioner:
|
||||
name: ansible
|
||||
options:
|
||||
verbose: true
|
||||
verifier:
|
||||
name: ansible
|
10
roles/xanmanning.k3s/molecule/debug/prepare.yml
Normal file
10
roles/xanmanning.k3s/molecule/debug/prepare.yml
Normal file
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
- name: Prepare
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Ensure apt cache is updated and iptables is installed
|
||||
ansible.builtin.apt:
|
||||
name: iptables
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_pkg_mgr == 'apt'
|
9
roles/xanmanning.k3s/molecule/debug/verify.yml
Normal file
9
roles/xanmanning.k3s/molecule/debug/verify.yml
Normal file
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
# This is an example playbook to execute Ansible tests.
|
||||
|
||||
- name: Verify
|
||||
hosts: all
|
||||
tasks:
|
||||
- name: Example assertion
|
||||
ansible.builtin.assert:
|
||||
that: true
|
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue