Skip to content

Commit 0af05e5

Browse files
danpawlikdanpawlik
committed
Add crc-cloud Ansible role
The Ansible tool might handle in better way how to deploy the CRC cloud.
1 parent 4be45c7 commit 0af05e5

22 files changed

+632
-0
lines changed

‎ansible/README.md

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Deploy CRC cloud directly on CRC host
2+
3+
## Introduction
4+
5+
The CRC cloud tool deploys the CRC host using its own binary, but it
6+
requires access to the cloud provider credentials. That functionality
7+
is useless when the CRC cloud needs to be used in externa CI, where
8+
the crc-cloud tool can not be used - especially when the CI is responsible
9+
to check how many VMs are spawned or checking job results.
10+
11+
## CRC QCOW2 image
12+
13+
There is a simply way to bootstrap the CRC without using the crc-cloud
14+
tool and upload it to your cloud provider:
15+
16+
- download libvirt bundle (you can see url when crc is in debug mode)
17+
- extract libvirt bundle using tar command with zst:
18+
19+
```shell
20+
tar xaf crc_libvirt_$VERSION_amd64.crcbundle
21+
```
22+
23+
- upload crc.qcow2 image to your cloud provider
24+
- take the id_ecdsa_crc file
25+
26+
## Bootstrap crc-cloud directly on host
27+
28+
Now after spawning VM using the `crc.qcow2` image:
29+
30+
- prepare `inventory.yaml` file:
31+
32+
```shell
33+
CRC_VM_IP=<ip address>
34+
35+
cat << EOF > inventory.yaml
36+
---
37+
all:
38+
hosts:
39+
crc-cloud.dev:
40+
ansible_port: 22
41+
ansible_host: $CRC_VM_IP
42+
ansible_user: core
43+
vars:
44+
openshift_pull_secret: |
45+
< PULL SECRET >
46+
EOF
47+
```
48+
49+
- clone crc-cloud project (FIXME: change repository)
50+
51+
```shell
52+
git clone https://github.com/danpawlik/crc-cloud -b add-ansible-role
53+
```
54+
55+
- run playbook to boostrap the container that later would start deploy-crc-cloud role
56+
57+
```shell
58+
ansible-playbook -i inventory.yaml crc-cloud/ansible/playbooks/bootstrap.yaml
59+
```

‎ansible/playbooks/bootstrap.yaml

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
- name: Prepare and create container to start crc-cloud playbook
3+
hosts: crc-cloud.dev
4+
tasks:
5+
# FIXME: change to main repository
6+
- name: Clone crc-cloud repository
7+
ansible.builtin.git:
8+
repo: https://github.com/danpawlik/crc-cloud
9+
dest: crc-cloud
10+
version: add-ansible-role
11+
12+
- name: Check if boostrap ssh key exists
13+
ansible.builtin.stat:
14+
path: .ssh/crc-cloud-bootstrap.pub
15+
register: _boostrap_ssh_key
16+
17+
- name: Generate ssh keypair
18+
when: not _boostrap_ssh_key.stat.exists
19+
community.crypto.openssh_keypair:
20+
path: .ssh/crc-cloud-bootstrap
21+
type: ed25519
22+
state: present
23+
owner: core
24+
group: core
25+
26+
- name: Add generated key to authorized keys
27+
ansible.builtin.shell: |
28+
cat .ssh/crc-cloud-bootstrap.pub >> .ssh/authorized_keys.d/ignition
29+
30+
# FIXME: move it to dedicated files
31+
- name: Create entrypoint file
32+
ansible.builtin.copy:
33+
content: |
34+
#!/bin/bash
35+
36+
echo "Check if inventory.yaml exists..."
37+
if [ -f "inventory.yaml" ]; then
38+
echo "Starting Ansible..."
39+
export ANSIBLE_HOST_KEY_CHECKING=False
40+
export ANSIBLE_LOG_PATH=/home/user/ansible-logs/ansible.log
41+
ansible-playbook -i inventory.yaml crc-cloud/ansible/playbooks/start.yaml
42+
else
43+
echo "Could not find inventory file. Exit"
44+
exit 1
45+
fi
46+
dest: entrypoint.sh
47+
48+
- name: Prepare Dockerfile
49+
ansible.builtin.copy:
50+
content: |
51+
FROM quay.io/centos/centos:stream9
52+
53+
RUN dnf install -y ansible-core sudo && \
54+
ansible-galaxy collection install community.general \
55+
community.crypto ansible.posix \
56+
kubernetes.core
57+
58+
59+
RUN groupadd --gid 1000 user && \
60+
useradd --uid 1000 --gid 1000 -d /home/user user
61+
COPY entrypoint.sh /home/user/entrypoint.sh
62+
RUN chown -R user:user /home/user && chmod +x /home/user/entrypoint.sh
63+
64+
# FIXME - change root to user
65+
USER root
66+
67+
WORKDIR /home/user
68+
ENTRYPOINT ["/home/user/entrypoint.sh"]
69+
70+
dest: Dockerfile
71+
72+
- name: Build bootstrap container
73+
ansible.builtin.shell: |
74+
podman build -t crc-cloud-bootstrap -f Dockerfile
75+
76+
- name: Create inventory file
77+
ansible.builtin.copy:
78+
content: |
79+
---
80+
all:
81+
hosts:
82+
crc:
83+
ansible_port: 22
84+
ansible_host: {{ ansible_default_ipv4.address }}
85+
ansible_user: core
86+
ansible_ssh_private_key_file: /home/user/.ssh/id_ed25519
87+
vars:
88+
openshift_pull_secret: |
89+
{{ openshift_pull_secret }}
90+
dest: inventory.yaml
91+
92+
- name: Create Ansible log directory
93+
ansible.builtin.file:
94+
path: "{{ item }}"
95+
state: directory
96+
owner: core
97+
group: core
98+
loop:
99+
- ansible-logs
100+
- .kube
101+
102+
- name: Create container to boostrap
103+
ansible.builtin.shell: >
104+
podman create --name crc-cloud-boostrap
105+
--network host
106+
-v "/var/home/core/.ssh/crc-cloud-bootstrap:/home/user/.ssh/id_ed25519:z"
107+
-v "/var/home/core/inventory.yaml:/home/user/inventory.yaml:z"
108+
-v "/var/home/core/crc-cloud:/home/user/crc-cloud:z"
109+
-v "/var/home/core/ansible-logs:/home/user/ansible-logs:z"
110+
-v "/var/home/core/.kube:/home/user/.kube:z"
111+
crc-cloud-bootstrap
112+
113+
- name: Start the container
114+
ansible.builtin.shell: |
115+
podman start crc-cloud-boostrap

‎ansible/playbooks/roles

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../roles

‎ansible/playbooks/start.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
# NOTE: The playbook by default will create nested and extracted image.
3+
- name: Start crc-cloud
4+
gather_facts: true
5+
hosts: crc
6+
roles:
7+
- deploy-crc-cloud

‎ansible/roles/deploy-crc-cloud/defaults/main.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
dnsmasq_conf_path: /etc/dnsmasq.d/crc-dnsmasq.conf
3+
openshift_pull_secret: ""
4+
eip: crc.dev
5+
alternative_domain: nip.io
6+
7+
# wait for resource
8+
max_retry: 20
9+
wait_interval: 5
10+
11+
# wait cluster become healthy
12+
max_retries: 20
13+
retry_delay: 5
14+
15+
pass_developer: _PASS_DEVELOPER_
16+
pass_kubeadmin: _PASS_KUBEADMIN_
17+
pass_redhat: _PASS_REDHAT_
18+
19+
users:
20+
- name: developer
21+
password: "{{ pass_developer }}"
22+
- name: kubeadmin
23+
password: "{{ pass_kubeadmin }}"
24+
- name: redhat
25+
password: "{{ pass_redhat }}"
26+
27+
# replace default ca
28+
ca_user: "system:admin"
29+
ca_group: "system:masters"
30+
ca_user_subj: "/O=${GROUP}/CN=${USER}"
31+
ca_name: "custom"
32+
ca_subj: "/OU=openshift/CN=admin-kubeconfig-signer-custom"
33+
ca_validity: 3650

‎ansible/roles/deploy-crc-cloud/tasks/console_route.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
# https://github.com/crc-org/crc-cloud/blob/main/pkg/bundle/setup/clustersetup.sh#L282
3+
- name: Get route to console custom
4+
ansible.builtin.shell: |
5+
oc get route console-custom -n openshift-console
6+
register: _route_console_custom
7+
until: _route_console_custom.rc != 1
8+
retries: 60
9+
delay: 10
10+
changed_when: false
11+
12+
- name: Get console route
13+
ansible.builtin.shell: >
14+
oc get route console-custom
15+
-n openshift-console
16+
-o json | jq -r '.spec.host'

‎ansible/roles/deploy-crc-cloud/tasks/create_certificate_and_patch_secret.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
# https://github.com/crc-org/crc-cloud/blob/main/pkg/bundle/setup/clustersetup.sh#L185
3+
- name: Create alternative cert
4+
ansible.builtin.shell: >
5+
openssl req
6+
-newkey rsa:2048
7+
-new -nodes
8+
-x509
9+
-days 3650
10+
-keyout nip.key
11+
-out nip.crt
12+
-subj "/CN={{ eip }}.{{ alternative_domain }}"
13+
-addext "subjectAltName=DNS:apps.{{ eip }}.{{ alternative_domain }},DNS:*.apps.{{ eip }}.{{ alternative_domain }},DNS:api.{{ eip }}.{{ alternative_domain }}"
14+
15+
- name: "Create secret for {{ alternative_domain }}"
16+
ansible.builtin.command: >
17+
oc create secret tls nip-secret
18+
--cert=nip.crt
19+
--key=nip.key
20+
-n openshift-config

‎ansible/roles/deploy-crc-cloud/tasks/dnsmasq.yaml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# From https://github.com/crc-org/crc-cloud/blob/main/pkg/bundle/setup/clustersetup.sh#L101
3+
- name: Create crc-dnsmasq.conf
4+
become: true
5+
ansible.builtin.copy:
6+
content: |
7+
listen-address={{ ansible_default_ipv4.address }}
8+
expand-hosts
9+
log-queries
10+
local=/crc.testing/
11+
domain=crc.testing
12+
address=/apps-crc.testing/{{ ansible_default_ipv4.address }}
13+
address=/api.crc.testing/{{ ansible_default_ipv4.address }}
14+
address=/api-int.crc.testing/{{ ansible_default_ipv4.address }}
15+
address=/{{ ansible_fqdn }}.crc.testing/192.168.126.11
16+
dest: "{{ dnsmasq_conf_path }}"
17+
register: _dnsmasq_conf
18+
19+
- name: Set this host as first nameserver in /etc/resolv.conf
20+
become: true
21+
ansible.builtin.lineinfile:
22+
path: /etc/resolv.conf
23+
regexp: '^# Generated by NetworkManager'
24+
line: "nameserver {{ item }}"
25+
create: true
26+
loop: "{{ [ansible_default_ipv4.address] + ansible_facts['dns']['nameservers'] | flatten }}"
27+
register: _etc_resolv
28+
29+
- name: Disable overwriting /etc/resolv.conf by the NetworkManager
30+
become: true
31+
ansible.builtin.copy:
32+
content: |
33+
[main]
34+
dns=none
35+
dest: /etc/NetworkManager/conf.d/00-custom-crc.conf
36+
register: _disable_dns_overwrite
37+
38+
- name: Restart NetworkManager when its needed
39+
when: _disable_dns_overwrite.changed
40+
become: true
41+
ansible.builtin.systemd:
42+
name: NetworkManager
43+
state: restarted
44+
45+
- name: Restart dnsmasq
46+
when: _etc_resolv.changed
47+
become: true
48+
ansible.builtin.systemd:
49+
name: dnsmasq
50+
state: restarted
51+
enabled: true

‎ansible/roles/deploy-crc-cloud/tasks/get_htpasswd.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
- name: "Get htpasswd for {{ user.name }}"
3+
ansible.builtin.shell: |
4+
podman run --rm -ti xmartlabs/htpasswd {{ user.name }} {{ user.password }}
5+
register: _user_hash
6+
7+
- name: Create htpasswd.txt
8+
ansible.builtin.lineinfile:
9+
path: htpasswd.txt
10+
line: "{{ _user_hash.stdout }}"
11+
create: true

‎ansible/roles/deploy-crc-cloud/tasks/kubeconfig.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
- name: Create kube directory
3+
ansible.builtin.file:
4+
path: .kube
5+
state: directory
6+
owner: core
7+
group: core
8+
9+
- name: Copy kubeconfig to user dir
10+
ansible.builtin.copy:
11+
src: /opt/kubeconfig
12+
dest: .kube/config
13+
remote_src: true
14+
owner: core
15+
group: core

‎ansible/roles/deploy-crc-cloud/tasks/kubelet.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
# https://github.com/crc-org/crc-cloud/blob/main/pkg/bundle/setup/clustersetup.sh#L132
3+
- name: Start and enable kubelet
4+
become: true
5+
ansible.builtin.systemd:
6+
name: kubelet
7+
state: started
8+
enabled: true
9+
10+
- name: Wait for port 6443 to be up
11+
ansible.builtin.wait_for:
12+
timeout: 300
13+
port: 6443
14+
delay: 60
15+
16+
- name: Wait for API to start before continue
17+
ansible.builtin.command: >
18+
oc get pods --all-namespaces
19+
register: _openshift_containers
20+
until: |
21+
('No resources found' not in _openshift_containers.stdout) or
22+
('connect: connection refused' not in _openshift_containers.stderr) or
23+
('get current server API group list' not in _openshift_containers.stderr)
24+
retries: 60
25+
delay: 20
26+
changed_when: false
27+
failed_when:
28+
- "'connect: connection refused' in _openshift_containers.stderr"
29+
- "'get current server API group list' in _openshift_containers.stderr"
30+
- _openshift_containers.rc != 0

‎ansible/roles/deploy-crc-cloud/tasks/login.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
# https://github.com/crc-org/crc-cloud/blob/main/pkg/bundle/setup/clustersetup.sh#L67
3+
- name: Try to login after all changes
4+
ansible.builtin.command: >
5+
oc login
6+
--insecure-skip-tls-verify=true
7+
-u kubeadmin
8+
-p "{{ pass_kubeadmin }}"
9+
https://api.crc.testing:6443
10+
register: _openshift_login
11+
until: _openshift_login.rc != 1
12+
retries: 60
13+
delay: 10
14+
changed_when: false

0 commit comments

Comments
 (0)