deploy_dfaas.yaml

---
- name: Setup a DFaaS node
  tags: [setup]
  hosts: all
  become: true
  vars:
    openfaas_url: "http://127.0.0.1:31112"
    user_home: "{{ ansible_facts['user_dir'] }}"

  tasks:
    - name: Disable APT automatic upgrades
      ansible.builtin.copy:
        dest: /etc/apt/apt.conf.d/99-disable-auto-upgrades
        owner: root
        group: root
        mode: "0644"
        content: |
          # Custom config by Emanuele Petriglia.
          APT::Periodic::Enable "0";
          APT::Periodic::Update-Package-Lists "0";
          APT::Periodic::Unattended-Upgrade "0";

    - name: Configure sudo to preserve some environment variables
      ansible.builtin.copy:
        dest: /etc/sudoers.d/99-preserve-env
        owner: root
        group: root
        mode: "0440"
        content: |
          Defaults:%sudo env_keep += "KUBECONFIG"
          Defaults !always_set_home

    # sudo apt install -y buildah
    - name: Install buildah
      ansible.builtin.apt:
        name: buildah
        state: present

    # sudo ufw disable
    - name: Disable UFW firewall
      community.general.ufw:
        state: disabled

    - name: Increase number of allowed file descriptors and processes (for HAProxy)
      ansible.builtin.blockinfile:
        path: /etc/security/limits.conf
        marker: "# {mark} ANSIBLE MANAGED BLOCK: unlimited nofile/nproc"
        block: |
          * soft nofile unlimited
          * hard nofile unlimited
          * soft nproc unlimited
          * hard nproc unlimited

    - name: Tune IPv4 and TCP settings for kernel
      ansible.builtin.copy:
        dest: /etc/sysctl.d/20-k3s-custom.conf
        owner: root
        group: root
        mode: '0644'
        content: |
          # Maximum number of connections that can be queued for acceptance by
          # the kernel.
          net.core.somaxconn = 8192

          # Maximum number of half-open (SYN_RECV state) connections in the TCP
          # backlog queue.
          net.ipv4.tcp_max_syn_backlog = 8192

          # Ephemeral (short-lived) port range available for outbound
          # connections. Used also for communication between pods in the same
          # node.
          net.ipv4.ip_local_port_range = 5024 65535

          # Allow reuse of sockets in TIME_WAIT state for new outgoing
          # connections.
          net.ipv4.tcp_tw_reuse = 1

          # Time in seconds sockets stay in FIN_WAIT2 state.
          net.ipv4.tcp_fin_timeout = 5

          # Maximum number of packets allowed to queue on the network interface
          # receive buffer.
          net.core.netdev_max_backlog = 16384

          # Maximum number of tracked connections by the network connection
          # tracking (used by Kubernetes for service NAT/routing).
          net.netfilter.nf_conntrack_max = 262144

    # sudo -i
    # curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--disable traefik" sh -
    - name: Install K3S
      ansible.builtin.shell: curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--disable traefik" sh -
      args:
        executable: /bin/bash
        creates: /usr/local/bin/k3s  # Prevents re-installation if already installed

    # sudo systemctl enable --now k3s
    - name: Ensure k3s service is running
      ansible.builtin.systemd_service:
        name: k3s
        state: started
        enabled: yes

    - name: Add Helm APT repository
      ansible.builtin.deb822_repository:
        name: helm-stable-debian
        uris: https://packages.buildkite.com/helm-linux/helm-debian/any/
        suites: any
        components: [main]
        architectures: [amd64]
        signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey

    # sudo apt update && sudo apt install -y helm=3.20.2-1
    - name: Install Helm v3
      ansible.builtin.apt:
        # We need to pin Helm to version v3 because v4 is not backward
        # compatible and is not supported by DFaaS and the Ansible module.
        name: helm=3.20.2-1
        state: present
        update_cache: yes

    # echo "helm hold" | sudo dpkg --set-selections
    - name: Ensure Helm package won't be updated to v4
      ansible.builtin.dpkg_selections:
        name: helm
        selection: hold

    - name: Ensure KUBECONFIG env var exists for all users
      ansible.builtin.copy:
        dest: /etc/profile.d/kubeconfig.sh
        owner: root
        group: root
        mode: "0644"
        content: |
          # Let Helm connect to local k3s instance.
          export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

    - name: Install faas-cli
      block:
        # sudo mkdir -p /opt/bin && sudo chmod 0755 /opt/bin
        - name: Ensure /opt/bin directory exists
          ansible.builtin.file:
            path: /opt/bin/
            state: directory
            mode: '0755'

        # sudo curl -fL https://github.com/openfaas/faas-cli/releases/download/0.18.12/faas-cli -o /opt/bin/faas-cli && sudo chmod 0755 /opt/bin/faas-cli
        - name: Download faas-cli
          ansible.builtin.get_url:
            url: https://github.com/openfaas/faas-cli/releases/download/0.18.12/faas-cli
            dest: "/opt/bin/faas-cli"
            mode: '0755'

        - name: Ensure OPENFAAS_URL exists and PATH env var is updated for faas-cli
          ansible.builtin.copy:
            dest: /etc/profile.d/openfaas-faas-cli.sh
            mode: "0644"
            content: |
              # Let faas-cli connect to local OpenFaaS gateway.
              export OPENFAAS_URL={{ openfaas_url }}

              # Let all users run binaries in /opt/bin.
              export PATH="/opt/bin:$PATH"

    # sudo helm repo add haproxytech https://haproxytech.github.io/helm-charts
    - name: Ensure HAProxy's Helm repository is present
      kubernetes.core.helm_repository:
        name: haproxytech
        repo_url: https://haproxytech.github.io/helm-charts

    # sudo helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
    - name: Ensure Prometheus's Helm repository is present
      kubernetes.core.helm_repository:
        name: prometheus-community
        repo_url: https://prometheus-community.github.io/helm-charts

    # sudo helm repo add openfaas https://openfaas.github.io/faas-netes/
    - name: Ensure OpenFaaS's Helm repository is present
      kubernetes.core.helm_repository:
        name: openfaas
        repo_url: https://openfaas.github.io/faas-netes/


- name: Deploy DFaaS on a node
  tags: [deploy]
  hosts: all
  become: true
  vars:
    openfaas_url: "http://127.0.0.1:31112"
    user_home: "{{ ansible_facts['user_dir'] }}"

  environment:
    # Required to let Helm connect to the local k8s cluster.
    KUBECONFIG: /etc/rancher/k3s/k3s.yaml

  tasks:
    - name: Deploy Helm charts
      block:
        # sudo helm upgrade --install haproxy haproxytech/haproxy --version 1.28.1 --values k8s/charts/values-haproxy.yaml
        - name: Deploy HAProxy chart
          kubernetes.core.helm:
            name: haproxy
            chart_ref: haproxytech/haproxy
            chart_version: 1.28.1
            values_files: k8s/charts/values-haproxy.yaml
            release_namespace: default

        # This is a sidecar service exposed along with HAProxy.
        # sudo kubectl apply -f ./k8s/scripts/haproxy-metrics-exporter/service.yaml
        - name: Ensure haproxy-metrics-exporter service manifest is applied
          ansible.builtin.command: kubectl apply -f ./k8s/scripts/haproxy-metrics-exporter/service.yaml

        - name: Deploy Prometheus chart
          # sudo helm upgrade --install prometheus prometheus-community/prometheus --version 27.37.0 --values k8s/charts/values-prometheus.yaml
          kubernetes.core.helm:
            name: prometheus
            chart_ref: prometheus-community/prometheus
            chart_version: 27.37.0
            values_files: k8s/charts/values-prometheus.yaml
            release_namespace: default

        - name: Deploy OpenFaaS chart
          # sudo helm upgrade --install openfaas openfaas/openfaas --version 14.2.124 --values k8s/charts/values-openfaas.yaml
          kubernetes.core.helm:
            name: openfaas
            chart_ref: openfaas/openfaas
            chart_version: 14.2.124
            values_files: k8s/charts/values-openfaas.yaml
            release_namespace: default

        - name: Deploy rejector chart
          # sudo helm upgrade --install rejector {{ playbook_dir }}/k8s/scripts/rejector/helm --version 0.1.0 --values k8s/charts/values-rejector.yaml
          kubernetes.core.helm:
            name: rejector
            # Must be an absolute URL when passing a path!
            chart_ref: "{{ playbook_dir }}/k8s/scripts/rejector/helm"
            chart_version: 0.1.0
            values_files: k8s/charts/values-rejector.yaml
            release_namespace: default

    # OPENFAAS_URL=http://127.0.0.1:31112 PATH="$PATH:$HOME/.local/bin" ./k8s/scripts/deploy-functions.sh
    - name: Deploy OpenFaaS functions
      ansible.builtin.shell: ./k8s/scripts/deploy-functions.sh
      args:
        chdir: "{{ playbook_dir }}"
      environment:
        OPENFAAS_URL: "{{ openfaas_url }}"
        PATH: "{{ ansible_env.PATH }}:{{ user_home }}/.local/bin"