Merge pull request #269 from 100-hours-a-week/feat/v3-k8s-iac

fix: Ansible SSM 배포 안정성 수정

Author: WAFriend3416

IaC/3-v3/ansible/ansible.cfg

@@ -3,6 +3,4 @@ roles_path = ./roles
 inventory = ./inventory/aws_ec2.yaml
 host_key_checking = False
 timeout = 60
-
-[ssh_connection]
-pipelining = True
+deprecation_warnings = False

IaC/3-v3/ansible/inventory/aws_ec2.yaml

@@ -29,6 +29,7 @@ compose:
   ansible_host: instance_id
   ansible_connection: "'aws_ssm'"
   ansible_aws_ssm_region: "'ap-northeast-2'"
+  ansible_aws_ssm_bucket_name: "'dojangkok-v3-ansible-ssm'"
   ansible_user: ubuntu
   k8s_role: tags['k8s:role']
   k8s_nodepool: tags['k8s:nodepool']

IaC/3-v3/ansible/playbooks/site.yml

@@ -30,6 +30,8 @@
 - name: Install cluster components
   hosts: role_control_plane
   become: true
+  environment:
+    KUBECONFIG: /home/ubuntu/.kube/config
   roles:
     - calico
     - ebs-csi

IaC/3-v3/ansible/roles/calico/tasks/main.yml

@@ -23,7 +23,7 @@
       spec:
         calicoNetwork:
           ipPools:
-            - cidr: {{ pod_cidr }}
+            - cidr: "{{ pod_cidr }}"
               encapsulation: VXLAN
               natOutgoing: Enabled
           mtu: {{ calico_vxlan_mtu }}

IaC/3-v3/ansible/roles/kubeadm-init/tasks/main.yml

@@ -44,6 +44,12 @@
   set_fact:
     kubeadm_join_command: "{{ join_command.stdout }}"
 
+- name: Install Helm
+  shell: |
+    curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+  args:
+    creates: /usr/local/bin/helm
+
 - name: Label CP node
   command: >
     kubectl label node {{ inventory_hostname }}

IaC/3-v3/ansible/roles/kubeadm-join/tasks/main.yml

@@ -9,7 +9,7 @@
   register: kubelet_conf
 
 - name: Join cluster
-  command: "{{ hostvars[groups['role_control_plane'][0]].kubeadm_join_command }}"
+  command: "{{ hostvars[groups['role_control_plane'][0]].kubeadm_join_command }} --node-name={{ inventory_hostname }}"
   when: not kubelet_conf.stat.exists
 
 - name: Label worker node (from CP)

IaC/3-v3/aws/modules/iam/main.tf

@@ -83,3 +83,28 @@ resource "aws_iam_role_policy_attachment" "ssm" {
   role       = aws_iam_role.k8s_node.name
   policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
 }
+
+# --- S3 for Ansible SSM file transfer ---
+
+resource "aws_iam_role_policy" "ssm_s3" {
+  name = "ssm-s3-transfer"
+  role = aws_iam_role.k8s_node.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow"
+      Action = [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:DeleteObject",
+        "s3:GetBucketLocation",
+        "s3:ListBucket"
+      ]
+      Resource = [
+        "arn:aws:s3:::dojangkok-v3-ansible-ssm",
+        "arn:aws:s3:::dojangkok-v3-ansible-ssm/*"
+      ]
+    }]
+  })
+}

IaC/3-v3/aws/modules/k8s-nodes/main.tf

@@ -35,6 +35,7 @@ resource "aws_instance" "control_plane" {
   vpc_security_group_ids = var.cp_security_group_ids
   iam_instance_profile   = var.iam_instance_profile
   source_dest_check      = false
+  user_data              = local.ssm_user_data
 
   metadata_options {
     http_endpoint               = "enabled"
@@ -63,6 +64,15 @@ resource "aws_instance" "control_plane" {
 # --- Worker Nodes ---
 
 locals {
+  ssm_user_data = <<-EOF
+    #!/bin/bash
+    mkdir -p /tmp/ssm && cd /tmp/ssm
+    curl -fsSL "https://s3.amazonaws.com/ec2-downloads-ssm/latest/debian_arm64/amazon-ssm-agent.deb" -o amazon-ssm-agent.deb
+    dpkg -i amazon-ssm-agent.deb
+    systemctl enable amazon-ssm-agent
+    systemctl start amazon-ssm-agent
+  EOF
+
   # workers_per_az × 3 AZ → 플랫 맵 생성
   # e.g. workers_per_az=1 → { "w-2a-1"={az="a",...}, "w-2b-1"={...}, "w-2c-1"={...} }
   # e.g. workers_per_az=2 → { "w-2a-1"={...}, "w-2a-2"={...}, "w-2b-1"={...}, ... }
@@ -87,6 +97,7 @@ resource "aws_instance" "workers" {
   vpc_security_group_ids = var.worker_security_group_ids
   iam_instance_profile   = var.iam_instance_profile
   source_dest_check      = false
+  user_data              = local.ssm_user_data
 
   metadata_options {
     http_endpoint               = "enabled"