SQL query results and Experiments

.gitignore

@@ -0,0 +1,3 @@
+.idea
+.DS_Store
+ansible/rke/outputs/

ansible/cert-manager.yml

@@ -0,0 +1,62 @@
+---
+- hosts: controllers[0]
+  collections:
+    - kubernetes.core
+  tasks:
+    - name: Create cert-manager namespace
+      k8s:
+        kind: Namespace
+        name: cert-manager
+        state: present
+#      command: >
+#        /usr/local/bin/kubectl create namespace cert-manager
+#      ignore_errors: true
+
+    - name: Create cert manager CRDs
+      include_tasks: tasks/k8s-apply.yml
+      vars:
+        url: https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml
+#      shell: /usr/local/bin/kubectl apply --validate=false -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.11/deploy/manifests/00-crds.yaml
+
+    - name: Add cert manager helm repo
+      helm_repository:
+        name: jetstack
+        url: https://charts.jetstack.io
+#      shell: /usr/local/bin/helm repo add jetstack https://charts.jetstack.io
+#      ignore_errors: true
+
+#    - name: Update Helm repos
+#      shell: /usr/local/bin/helm repo update
+
+    - name: Render cluster issuer template
+      k8s:
+        template: templates/clusterissuer.yaml.j2
+        state: present
+
+#      template:
+#        src: clusterissuer.yaml.j2
+#        dest: /tmp/clusterissuer.yaml
+#
+#    - name: Create cert manager cluster issuer
+#      shell: /usr/local/bin/kubectl apply -f /tmp/clusterissuer.yaml
+
+    - name: Helm install cert-manager
+      helm:
+        name: cert-manager
+        namespace: cert-manager
+        chart_ref: jetstack/cert-manager
+        chart_version: "0.11.0"
+        values:
+          ingressShim:
+            defaultIssuerName: letsencrypt-prod
+            defaultIssuerKind: ClusterIssuer
+          webhook:
+            enabled: false
+#      command: >
+#        /usr/local/bin/helm upgrade --install cert-manager jetstack/cert-manager
+#        --namespace "cert-manager"
+#        --version "0.11.0"
+#        --set ingressShim.defaultIssuerName="letsencrypt-prod"
+#        --set ingressShim.defaultIssuerKind="ClusterIssuer"
+#        --set webhook.enabled=false
+#      ignore_errors: true

ansible/rke/defaults/main.yml

@@ -0,0 +1,5 @@
+#rke_version: "v1.20.4+rke2r1"
+rke_version: "v1.19.9+rke2r1"
+rke_container_image: "rancher/rke2-runtime:v1.20.4-rke2r1"
+token: /var/lib/rancher/rke2/server/node-token
+kubeconfig: /etc/rancher/rke2/rke2.yaml

ansible/rke/main.yml

@@ -0,0 +1,48 @@
+---
+- name: Configure a Kubernetes cluster using RKE2
+  hosts: controllers[0]
+  become: yes
+  tags: leader
+  vars_files:
+    - defaults/main.yml
+  tasks:
+    - name: Setup the leader
+      include_tasks: tasks/leader.yml
+    - name: Fetch the kubeconfig file.
+      fetch:
+        src: "{{ kubeconfig }}"
+        dest: outputs/{{ ansible_hostname }}.kube.config
+        flat: yes
+
+- name: Load the join token needed by the controllers and agents
+  hosts: controllers[0]
+  become: yes
+  tags: always
+  vars_files:
+    - defaults/main.yml
+  tasks:
+    - name: Copy the token nodes will need to join the cluster.
+      slurp:
+        src: "{{ token }}"
+      register: join_token
+    - name: Display the join token
+      debug:
+        msg: "Token {{ join_token.content | b64decode}}"
+
+- name: Configure the rest of the controllers
+  hosts: controllers[1:]
+  become: yes
+  tags: controllers
+  vars_files:
+    - defaults/main.yml
+  tasks:
+    - include_tasks: tasks/controllers.yml
+
+- name: Configure the agent nodes
+  hosts: agents
+  become: yes
+  tags: agents
+  vars:
+    rke_version: "v1.20.4+rke2r1"
+  tasks:
+    - include_tasks: tasks/agents.yml

ansible/rke/tasks/agents.yml

@@ -0,0 +1,16 @@
+---
+- name: Ensure the RKE2 config directory exists
+  file:
+    path: /etc/rancher/rke2
+    state: directory
+- name: Generate the config
+  vars:
+    node_token: "{{ hostvars[groups['controllers'][0]].join_token.content | b64decode }}"
+    server: "{{ hostvars[groups['controllers'][0]]['ansible_ssh_host'] }}"
+  template:
+    src: templates/rke2_agent.yml.j2
+    dest: /etc/rancher/rke2/config.yaml
+- name: Install the RKE2 binary
+  include_tasks: tasks/install-rke2.yml
+  vars:
+    type: agent

ansible/rke/tasks/controllers.yml

@@ -0,0 +1,19 @@
+---
+- name: Ensure the RKE2 config directory exists
+  file:
+    path: /etc/rancher/rke2
+    state: directory
+- name: Generate the config
+  vars:
+    node_token: "{{ hostvars[groups['controllers'][0]].join_token.content | b64decode }}"
+    server: "{{ hostvars[groups['controllers'][0]]['ansible_ssh_host'] }}"
+    leader: false
+  template:
+    src: templates/rke2_server.yml.j2
+    dest: /etc/rancher/rke2/config.yaml
+    mode: 0600
+- name: Install the RKE2 binary
+  include_tasks: tasks/install-rke2.yml
+  vars:
+    type: server
+

ansible/rke/tasks/install-rke2.yml

@@ -0,0 +1,9 @@
+- name: Install the rke2 binary
+  shell:
+    cmd: curl -sfL https://get.rke2.io | INSTALL_RKE2_VERSION="{{ rke_version }}" INSTALL_RKE2_TYPE="{{ type }}" sh -
+    creates: /usr/local/bin/rke2
+- name: Enable and start the rke2-{{ type }}.service
+  systemd:
+    name: rke2-{{ type }}.service
+    enabled: true
+    state: started

ansible/rke/tasks/leader.yml

@@ -0,0 +1,76 @@
+---
+- name: Ensure the /etc/rancher/rke2 director exists.
+  become: yes
+  file:
+    path: /etc/rancher/rke2
+    state: directory
+    recurse: yes
+- name: Generate the config
+  vars:
+    node_token: unused
+    server: unused
+    leader: true
+  template:
+    src: templates/rke2_server.yml.j2
+    dest: /etc/rancher/rke2/config.yaml
+    mode: 0600
+- name: Install the rke2 binary
+  include_tasks: install-rke2.yml
+  vars:
+    type: server
+- name: Wait for the token to be created
+  wait_for:
+    path: /var/lib/rancher/rke2/server/node-token
+    state: present
+
+- name: Check if kubectl exists in /usr/local/bin
+  stat:
+    path: /usr/local/bin/kubectl
+  register: kubectl_test
+
+- name: Link kubectl into /usr/local/bin
+  become: yes
+  file:
+    src: /var/lib/rancher/rke2/bin/kubectl
+    path: /usr/local/bin/kubectl
+    state: link
+  when: not kubectl_test.stat.exists
+
+- name: Create the .kube directory for root and ubuntu users
+  become: yes
+  file:
+    path: "{{ item.path }}"
+    owner: "{{ item.owner }}"
+    state: directory
+  loop:
+    - path: /root/.kube
+      owner: root
+    - path: /home/ubuntu/.kube
+      owner: ubuntu
+
+- name: Copy kubeconfig files for root and ubuntu users
+  become: yes
+  copy:
+    src: "{{ kubeconfig }}"
+    dest: "{{ item.path }}/config"
+    owner: "{{ item.owner }}"
+    mode: 0600
+    remote_src: yes
+  loop:
+    - path: /root/.kube
+      owner: root
+    - path: /home/ubuntu/.kube
+      owner: ubuntu
+
+- name: Patch the server address in the original kubeconfig
+  become: yes
+  lineinfile:
+    path: "{{ kubeconfig }}"
+    regexp: 'server: https://127\.0\.0\.1:6443'
+    line: "    server: https://{{ ansible_ssh_host }}:6443"
+
+- name: Download the kubeconfig
+  fetch:
+    src: "{{ kubeconfig }}"
+    dest: outputs/{{ ansible_hostname }}.kube.config
+    flat: yes

ansible/rke/templates/rke2_agent.yml.j2

@@ -0,0 +1,4 @@
+node-name: {{ ansible_fqdn }}
+token: {{ node_token }}
+server: https://{{ server }}:9345
+

ansible/rke/templates/rke2_server.yml.j2

@@ -0,0 +1,12 @@
+node-name: {{ ansible_fqdn }}
+{% if not leader %}
+token: {{ node_token }}
+server: https://{{ server }}:9345
+{% endif %}
+
+write-kubeconfig-mode: "0600"
+disable: rke2-ingress-nginx
+tls-san:
+  - {{ ansible_fqdn }}
+  - {{ ansible_hostname }}
+  - {{ ansible_ssh_host }}

ansible/rke/uninstall.yml

@@ -0,0 +1,12 @@
+---
+- hosts: nodes
+  become: yes
+  tasks:
+    - name: kill all
+      shell: /usr/local/bin/rke2-killall.sh
+    - name: uninstall
+      shell: /usr/local/bin/rke2-uninstall.sh
+    - name: Reboot
+      reboot:
+    - name: Reboot
+      reboot: