starlingx/ansible-playbooks
Code Issues Proposed changes

Merge "Deploy FluxCD helm and source controller pods for updating app framework."

Browse Source
This commit is contained in:
Zuul 2021-09-10 17:56:25 +00:00 committed by Gerrit Code Review
commit 19156c38f0
9 changed files with 2056 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/tasks/bringup_fluxcd.yml Normal file
View File

@ -0,0 +1,77 @@
---
#
# Copyright (c) 2021 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
# DESCRIPTION:
# These tasks configure and launch FluxCD helm and source controllers.
#
# Create a temporary directory and copy FluxCD resource files for kubectl.
- name: Set up FluxCD resource files
block:
- name: Create FluxCD resource directory
file:
path: "{{ fluxcd_resource_dir }}"
state: directory
- name: Create FluxCD resource files from templates
template:
src: "{{ item }}"
dest: "{{ fluxcd_resource_dir }}/{{ item | basename | regex_replace('\\.j2$', '') }}"
with_fileglob:
- "{{ role_path }}/templates/fluxcd-*.j2"
- name: Configure and launch FluxCD helm and source controllers
block:
# Create the FluxCD namespace. This is used for the local registry secret.
- name: Create namespace for FluxCD
command: kubectl create namespace {{ fluxcd_namespace }}
register: create_fluxcd_ns
failed_when: false
environment:
KUBECONFIG: /etc/kubernetes/admin.conf
- name: Fail if creating namespace fails
fail:
msg: "Failed to create {{ fluxcd_namespace }} namespace. Error: {{ create_fluxcd_ns.stderr }}"
when: create_fluxcd_ns.rc !=0 and create_fluxcd_ns.stderr is not search('AlreadyExists')
- name: Check if flux helm and source controllers exist
command: kubectl -n {{ fluxcd_namespace }} get pods
register: fluxcd_get_pods
failed_when: false
environment:
KUBECONFIG: /etc/kubernetes/admin.conf
- block:
- name: Check if secret exists
command: kubectl -n {{ fluxcd_namespace }} get secret {{ fluxcd_secret_name }}
register: fluxcd_get_secret
failed_when: false
environment:
KUBECONFIG: /etc/kubernetes/admin.conf
- name: Create secret if it doesn't exist
command: >-
kubectl -n {{ fluxcd_namespace }} create secret docker-registry {{ fluxcd_secret_name }}
--docker-server={{ local_registry }}
--docker-username={{ local_registry_credentials['username'] }}
--docker-password={{ local_registry_credentials['password'] }}
when: fluxcd_get_secret.rc !=0
environment:
KUBECONFIG: /etc/kubernetes/admin.conf
- name: Install flux helm and source controllers
command: kubectl create -f {{ fluxcd_resource_dir }}
register: create_fluxcd_pods
environment:
KUBECONFIG: /etc/kubernetes/admin.conf
when: fluxcd_get_pods.stderr is search('No resources found')
always:
- name: Clean FluxCD resource directory
file:
path: "{{ fluxcd_resource_dir }}"
state: absent

9
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/tasks/main.yml
View File

@ -1,6 +1,6 @@
---
#
# Copyright (c) 2019 Wind River Systems, Inc.
# Copyright (c) 2019-2021 Wind River Systems, Inc.
#
# SPDX-License-Identifier: Apache-2.0
#
@ -92,6 +92,9 @@
- name: Bring up Helm
import_tasks: bringup_helm.yml
- name: Bring up FluxCD helm and source controllers
import_tasks: bringup_fluxcd.yml
- name: Bring up essential flock services
import_tasks: bringup_flock_services.yml
@ -203,7 +206,7 @@
with_items: "{{ kube_component_list }}"
register: wait_for_kube_system_pods
- name: Start wait for armada, calico-kube-controllers & coredns deployments to reach Available state
- name: Start wait for armada, fluxcd, calico-kube-controllers & coredns deployments to reach Available state
# Check the deployment status rather than the pod status in case some pods are down on other nodes
command: >-
kubectl --kubeconfig=/etc/kubernetes/admin.conf wait --namespace={{ item.namespace }}
@ -212,6 +215,8 @@
poll: 0
with_items:
- { namespace: kube-system, deployment: calico-kube-controllers }
- { namespace: flux-helm, deployment: helm-controller }
- { namespace: flux-helm, deployment: source-controller }
- { namespace: armada, deployment: armada-api }
- { namespace: kube-system, deployment: coredns }
register: wait_for_deployments

1731
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/templates/fluxcd-crds.yaml.j2 Normal file
View File

File diff suppressed because it is too large Load Diff

146
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/templates/fluxcd-deployments.yaml.j2 Normal file
View File

@ -0,0 +1,146 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
control-plane: controller
name: helm-controller
namespace: flux-helm
spec:
replicas: 1
selector:
matchLabels:
app: helm-controller
template:
metadata:
annotations:
prometheus.io/port: "8080"
prometheus.io/scrape: "true"
labels:
app: helm-controller
spec:
containers:
- args:
- --watch-all-namespaces
- --log-level=info
- --log-encoding=json
- --enable-leader-election
env:
- name: RUNTIME_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: "{{ local_registry }}/{{ flux_helm_controller_img }}"
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /healthz
port: healthz
name: manager
ports:
- containerPort: 8080
name: http-prom
- containerPort: 9440
name: healthz
protocol: TCP
readinessProbe:
httpGet:
path: /readyz
port: healthz
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 100m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
name: temp
nodeSelector:
node-role.kubernetes.io/master: ""
terminationGracePeriodSeconds: 600
volumes:
- emptyDir: {}
name: temp
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
control-plane: controller
name: source-controller
namespace: flux-helm
spec:
replicas: 1
selector:
matchLabels:
app: source-controller
strategy:
type: Recreate
template:
metadata:
annotations:
prometheus.io/port: "8080"
prometheus.io/scrape: "true"
labels:
app: source-controller
spec:
containers:
- args:
- --watch-all-namespaces
- --log-level=info
- --log-encoding=json
- --enable-leader-election
- --storage-path=/data
- --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.
env:
- name: RUNTIME_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: "{{ local_registry }}/{{ flux_source_controller_img }}"
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /healthz
port: healthz
name: manager
ports:
- containerPort: 9090
name: http
- containerPort: 8080
name: http-prom
- containerPort: 9440
name: healthz
readinessProbe:
httpGet:
path: /
port: http
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 50m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /data
name: data
- mountPath: /tmp
name: tmp
nodeSelector:
node-role.kubernetes.io/master: ""
securityContext:
fsGroup: 1337
terminationGracePeriodSeconds: 10
volumes:
- emptyDir: {}
name: data
- emptyDir: {}
name: tmp

72
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/templates/fluxcd-rbac.yaml.j2 Normal file
View File

@ -0,0 +1,72 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: crd-controller
namespace: flux-helm
rules:
- apiGroups:
- source.toolkit.fluxcd.io
resources:
- '*'
verbs:
- '*'
- apiGroups:
- kustomize.toolkit.fluxcd.io
resources:
- '*'
verbs:
- '*'
- apiGroups:
- helm.toolkit.fluxcd.io
resources:
- '*'
verbs:
- '*'
- apiGroups:
- notification.toolkit.fluxcd.io
resources:
- '*'
verbs:
- '*'
- apiGroups:
- ""
resources:
- configmaps
- configmaps/status
verbs:
- '*'
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: crd-controller
namespace: flux-helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: crd-controller
subjects:
- kind: ServiceAccount
name: default
namespace: flux-helm
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-reconciler
namespace: flux-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: default
namespace: flux-helm

16
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/templates/fluxcd-service.yaml.j2 Normal file
View File

@ -0,0 +1,16 @@
apiVersion: v1
kind: Service
metadata:
labels:
control-plane: controller
name: source-controller
namespace: flux-helm
spec:
ports:
- name: http
port: 80
protocol: TCP
targetPort: http
selector:
app: source-controller
type: ClusterIP

3
playbookconfig/src/playbooks/roles/bootstrap/bringup-essential-services/vars/main.yml
View File

@ -29,6 +29,9 @@ k8s_cgroup_name: k8s-infra
kubeadm_pki_dir: /etc/kubernetes/pki
etcd_tmp_dir: /opt/backups/etcd_tmp_dir
psp_file: /usr/share/ansible/stx-ansible/playbooks/roles/bootstrap/bringup-essential-services/files/psp-policies.yaml
fluxcd_namespace: flux-helm
fluxcd_secret_name: default-registry-key
fluxcd_resource_dir: /tmp/fluxcd
# Kubernetes api server encryption provider configuration file
encryption_provider_config: /etc/kubernetes/encryption-provider.yaml

2
playbookconfig/src/playbooks/roles/common/load-images-information/tasks/main.yml
View File

@ -100,6 +100,8 @@
- "{{ armada_img }}"
- "{{ n3000_opae_img }}"
- "{{ kubernetes_entrypoint_img }}"
- "{{ flux_helm_controller_img }}"
- "{{ flux_source_controller_img }}"
storage_images:
- "{{ snapshot_controller_img }}"

2
playbookconfig/src/playbooks/roles/common/load-images-information/vars/k8s-v1.18.1/system-images.yml
View File

@ -16,3 +16,5 @@ sriov_network_device_img: docker.io/starlingx/k8s-plugins-sriov-network-device:s
# in the kubernetes github repo
snapshot_controller_img: quay.io/k8scsi/snapshot-controller:v2.0.0-rc2
rvmc_img: docker.io/starlingx/rvmc:stx.5.0-v1.0.0
flux_helm_controller_img: docker.io/fluxcd/helm-controller:v0.10.1
flux_source_controller_img: docker.io/fluxcd/source-controller:v0.13.2