feat(r2): k3s agents, and helm-2.0 chart values

---

# Playbook: install k3s

# Description: A single-node k3s cluster on each host in k3s_nodes, plus Helm and the

#   Python Kubernetes client, ready for playbooks/scenarios/r2_existing_cluster. A host

#   that already runs k3s keeps its cluster as it is.

# Description: k3s on each host in k3s_nodes: a server, or an agent joining the server

#   named in k3s_server. Servers also get Helm and the Python Kubernetes client, ready for

#   playbooks/scenarios/r2_existing_cluster. A host that already runs k3s keeps its

#   cluster as it is.

# Usage: ansible-playbook -i inventory/r2.local.yml playbooks/infrastructure/k3s/deploy.yml

- name: Install k3s

---

# Single-node k3s: the cluster, kubectl, Helm and the Python Kubernetes client the

# oop-platform role needs on the host it deploys to.

# k3s servers and agents. A server also gets kubectl, Helm and the Python Kubernetes

# client the oop-platform role needs on the host it deploys to.

# Pinned so two runs months apart install the same cluster. The k3s stable channel

# (https://update.k3s.io/v1-release/channels/stable) names the current one.

k3s_install_script_url: https://get.k3s.io

# Extra `k3s server` flags, e.g. ["--disable=traefik", "--tls-san=oop.example.org"].

k3s_server_args: []

# Extra `k3s agent` flags.

k3s_agent_args: []

# Empty: this host is a server. An inventory host name: this host joins that server as

# an agent (the server must be in the same play).

k3s_server: ""

# Node labels, e.g. ["topology.kubernetes.io/zone=a1"].

k3s_node_labels: []

# A host that already runs k3s is left as it is: its version and flags are reported,

# never changed. Set to true to reinstall it at k3s_version with k3s_server_args.

---

# One k3s install, server or agent (k3s_exec), joining a server when k3s_join is set.

- name: Install k3s

  block:

    - name: Download the k3s installer

      ansible.builtin.get_url:

        url: "{{ k3s_install_script_url }}"

        dest: /tmp/k3s-install.sh

        mode: "0700"

    - name: Run the k3s installer

      ansible.builtin.command: /tmp/k3s-install.sh

      environment: "{{ {'INSTALL_K3S_VERSION': k3s_version, 'INSTALL_K3S_EXEC': k3s_exec | join(' ')} | combine(k3s_join) }}"

      become: true

      changed_when: true

      no_log: "{{ k3s_join | length > 0 }}"  # the join token

  always:

    - name: Remove the k3s installer

      ansible.builtin.file:

        path: /tmp/k3s-install.sh

        state: absent

---

# Servers first, then agents: with the linear strategy every host runs a task before any

# host starts the next, so an agent's join only begins once its server is Ready.

- name: Check for an existing k3s

  ansible.builtin.stat:

    path: /usr/local/bin/k3s

      its flags and its workloads as they are. k3s_reinstall=true installs {{ k3s_version }}.

  when: k3s_binary.stat.exists and not k3s_reinstall | bool

- name: Install k3s

  when: not k3s_binary.stat.exists or k3s_reinstall | bool

  block:

    - name: Download the k3s installer

      ansible.builtin.get_url:

        url: "{{ k3s_install_script_url }}"

        dest: /tmp/k3s-install.sh

        mode: "0700"

    - name: Run the k3s installer

      ansible.builtin.command: /tmp/k3s-install.sh

      environment:

        INSTALL_K3S_VERSION: "{{ k3s_version }}"

        INSTALL_K3S_EXEC: "{{ (['server'] + k3s_server_args) | join(' ') }}"

      become: true

      changed_when: true

- name: Decide what this host installs

  ansible.builtin.set_fact:

    k3s_is_agent: "{{ k3s_server | length > 0 }}"

    k3s_install: "{{ not k3s_binary.stat.exists or k3s_reinstall | bool }}"

    k3s_label_args: "{{ k3s_node_labels | map('regex_replace', '^', '--node-label=') | list }}"

  always:

    - name: Remove the k3s installer

      ansible.builtin.file:

        path: /tmp/k3s-install.sh

        state: absent

- name: Install a k3s server

  when: k3s_install and not k3s_is_agent

  ansible.builtin.include_tasks: install.yml

  vars:

    k3s_exec: "{{ ['server'] + k3s_label_args + k3s_server_args }}"

    k3s_join: {}

- name: Wait for the node to be Ready

- name: Wait for the server to be Ready

  ansible.builtin.command: /usr/local/bin/k3s kubectl get nodes --no-headers

  become: true

  register: k3s_nodes

  retries: 30

  delay: 5

  changed_when: false

  when: not k3s_is_agent

- name: Find the kubeconfig user's home

  ansible.builtin.getent:

    database: passwd

    key: "{{ k3s_kubeconfig_user }}"

- name: Join agents to their server

  when: k3s_is_agent

  block:

    - name: Read the server's join token

      ansible.builtin.slurp:

        src: /var/lib/rancher/k3s/server/node-token

      # resolved before `when`, so never empty, even on a server that skips this

      delegate_to: "{{ k3s_server or inventory_hostname }}"

      become: true

      register: k3s_node_token

      no_log: true

      when: k3s_install

    - name: Install a k3s agent

      when: k3s_install

      ansible.builtin.include_tasks: install.yml

      vars:

        k3s_exec: "{{ ['agent'] + k3s_label_args + k3s_agent_args }}"

        k3s_join:

          K3S_URL: "https://{{ hostvars[k3s_server]['ansible_facts']['default_ipv4']['address'] }}:6443"

          K3S_TOKEN: "{{ k3s_node_token.content | b64decode | trim }}"

    - name: Wait for the agent to be Ready on its server

      ansible.builtin.command: >-

        /usr/local/bin/k3s kubectl get node {{ ansible_facts['hostname'] }} --no-headers

      # resolved before `when`, so never empty, even on a server that skips this

      delegate_to: "{{ k3s_server or inventory_hostname }}"

      become: true

      register: k3s_agent_node

      until: k3s_agent_node.rc == 0 and ' Ready ' in k3s_agent_node.stdout

      retries: 30

      delay: 5

      changed_when: false

# kubectl, Helm and the Python client only where the oop-platform role deploys from

- name: Point the user's kubeconfig at the cluster

  when: not k3s_is_agent

  vars:

    k3s_user_home: "{{ ansible_facts['getent_passwd'][k3s_kubeconfig_user][4] }}"

  block:

    - name: Find the kubeconfig user's home

      ansible.builtin.getent:

        database: passwd

        key: "{{ k3s_kubeconfig_user }}"

    - name: Check for ~/.kube

      ansible.builtin.stat:

        path: "{{ k3s_user_home }}/.kube"

    update_cache: true

    cache_valid_time: 3600

  become: true

  when: not k3s_is_agent

- name: Install Helm

  ansible.builtin.include_role:

    name: helm

  when: not k3s_is_agent

---

- name: Check for k3s

- name: Check for a k3s server

  ansible.builtin.stat:

    path: /usr/local/bin/k3s-uninstall.sh

  register: k3s_uninstaller

- name: Check for a k3s agent

  ansible.builtin.stat:

    path: /usr/local/bin/k3s-agent-uninstall.sh

  register: k3s_agent_uninstaller

- name: Remove a k3s agent (deletes every workload and volume on this node)

  ansible.builtin.command: /usr/local/bin/k3s-agent-uninstall.sh

  become: true

  changed_when: true

  when: k3s_agent_uninstaller.stat.exists

- name: Find the kubeconfig user's home

  ansible.builtin.getent:

    database: passwd