feat(ansible): add K3s installation playbooks and configuration templates

2026-02-09 14:03:42 +08:00
@@ -0,0 +1,4 @@
+---
+- name: Apply sysctl
+  ansible.builtin.command: sysctl --system
+
@@ -0,0 +1,46 @@
+# 基础配置 Role
+# 功能: hostname、sysctl、Tailscale 安装
+---
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ node_hostname }}"
+  when: node_hostname is defined
+
+- name: Update /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    regexp: '^127\.0\.1\.1'
+    line: "127.0.1.1 {{ node_hostname }}"
+  when: node_hostname is defined
+
+- name: Configure sysctl for IP forwarding
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/99-k3s.conf
+    content: |
+      net.ipv4.ip_forward = 1
+      net.ipv6.conf.all.forwarding = 1
+    mode: '0644'
+  notify: Apply sysctl
+
+- name: Install dependencies
+  ansible.builtin.apt:
+    name: [curl, wget, ca-certificates]
+    state: present
+    update_cache: yes
+
+- name: Check if Tailscale is installed
+  ansible.builtin.command: which tailscale
+  register: tailscale_check
+  ignore_errors: yes
+  changed_when: false
+
+- name: Install Tailscale
+  ansible.builtin.shell: curl -fsSL https://tailscale.com/install.sh | sh
+  when: tailscale_check.rc != 0
+
+- name: Enable Tailscale service
+  ansible.builtin.systemd:
+    name: tailscaled
+    enabled: yes
+    state: started
+
@@ -0,0 +1,103 @@
+# K3s 安装 Role (统一 Server 和 Agent)
+---
+- name: Validate TAILSCALE_AUTH_KEY
+  ansible.builtin.fail:
+    msg: "请设置环境变量: export TAILSCALE_AUTH_KEY='tskey-auth-xxx'"
+  when: tailscale_auth_key | length == 0
+
+- name: Validate K3S_TOKEN for join nodes
+  ansible.builtin.fail:
+    msg: "请设置环境变量: export K3S_TOKEN='xxx'"
+  when:
+    - not (cluster_init | default(false))
+    - k3s_token | length == 0
+
+- name: Create K3s config directory
+  ansible.builtin.file:
+    path: /etc/rancher/k3s
+    state: directory
+    mode: '0755'
+
+# Server 节点配置
+- name: Deploy K3s server config
+  ansible.builtin.template:
+    src: k3s-server.yaml.j2
+    dest: /etc/rancher/k3s/config.yaml
+    mode: '0600'
+  when: "'masters' in group_names"
+
+# Agent 节点配置
+- name: Deploy K3s agent config
+  ansible.builtin.template:
+    src: k3s-agent.yaml.j2
+    dest: /etc/rancher/k3s/config.yaml
+    mode: '0600'
+  when: "'agents' in group_names"
+
+# 镜像加速配置
+- name: Deploy registries.yaml
+  ansible.builtin.template:
+    src: registries.yaml.j2
+    dest: /etc/rancher/k3s/registries.yaml
+    mode: '0644'
+  when: use_mirror | default(false)
+
+# 安装 K3s
+- name: Set install URL
+  ansible.builtin.set_fact:
+    k3s_install_url: "{{ mirror_k3s_install_url if (use_mirror | default(false)) else global_k3s_install_url }}"
+    k3s_install_mirror: "{{ 'INSTALL_K3S_MIRROR=cn' if (use_mirror | default(false)) else '' }}"
+
+- name: Check if K3s is installed
+  ansible.builtin.stat:
+    path: /usr/local/bin/k3s
+  register: k3s_binary
+
+- name: Install K3s server
+  ansible.builtin.shell: |
+    curl -sfL {{ k3s_install_url }} | {{ k3s_install_mirror }} INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server
+  when:
+    - "'masters' in group_names"
+    - not k3s_binary.stat.exists
+
+- name: Install K3s agent
+  ansible.builtin.shell: |
+    curl -sfL {{ k3s_install_url }} | {{ k3s_install_mirror }} INSTALL_K3S_VERSION={{ k3s_version }} sh -s - agent
+  when:
+    - "'agents' in group_names"
+    - not k3s_binary.stat.exists
+
+# 等待 K3s 就绪 (仅 Server)
+- name: Wait for K3s server ready
+  ansible.builtin.wait_for:
+    path: /var/lib/rancher/k3s/server/node-token
+    timeout: 120
+  when: "'masters' in group_names"
+
+# 输出 Token (仅 cluster-init)
+- name: Get node token
+  ansible.builtin.slurp:
+    src: /var/lib/rancher/k3s/server/node-token
+  register: node_token
+  when: cluster_init | default(false)
+
+- name: Display node token
+  ansible.builtin.debug:
+    msg: |
+      ══════════════════════════════════════════════════════════════
+      K3S_TOKEN (用于添加新节点):
+      {{ node_token.content | b64decode | trim }}
+      
+      K3S_SERVER_URL:
+      https://{{ ansible_host }}:6443
+      ══════════════════════════════════════════════════════════════
+  when: cluster_init | default(false)
+
+# 保存 kubeconfig (仅 cluster-init)
+- name: Fetch kubeconfig
+  ansible.builtin.fetch:
+    src: /etc/rancher/k3s/k3s.yaml
+    dest: "{{ playbook_dir }}/../kubeconfig.yaml"
+    flat: yes
+  when: cluster_init | default(false)
+
@@ -0,0 +1,28 @@
+# K3s Agent 配置模板
+---
+server: "{{ k3s_server_url }}"
+token: "{{ k3s_token }}"
+
+# Tailscale VPN
+vpn-auth: "name=tailscale,joinKey={{ tailscale_auth_key }}{% if netfilter_mode | default('') %},extraArgs=--netfilter-mode={{ netfilter_mode }}{% endif %}"
+
+# 节点标签
+node-label:
+{% if node_region is defined %}
+  - "topology.kubernetes.io/region={{ node_region }}"
+{% endif %}
+{% if enable_lb is defined %}
+  - "svccontroller.k3s.cattle.io/enablelb={{ enable_lb | string | lower }}"
+{% endif %}
+{% if node_labels is defined %}
+{% for key, value in node_labels.items() %}
+  - "{{ key }}={{ value }}"
+{% endfor %}
+{% endif %}
+
+# Kubelet 资源预留
+{% if kubelet_reserved is defined %}
+kubelet-arg:
+  - "kube-reserved={{ kubelet_reserved }}"
+{% endif %}
+
@@ -0,0 +1,42 @@
+# K3s Server 统一配置模板 (master-init 和 master-join)
+---
+{% if cluster_init | default(false) %}
+# 首个节点初始化集群
+cluster-init: true
+{% else %}
+# 加入已有集群
+server: "{{ k3s_server_url }}"
+token: "{{ k3s_token }}"
+{% endif %}
+
+tls-san:
+  - "{{ k3s_tls_san }}"
+
+# ETCD 快照配置
+etcd-snapshot-retention: {{ etcd_snapshot_retention }}
+etcd-snapshot-schedule-cron: "{{ etcd_snapshot_schedule_cron }}"
+etcd-snapshot-compress: {{ etcd_snapshot_compress | lower }}
+
+# Tailscale VPN
+vpn-auth: "name=tailscale,joinKey={{ tailscale_auth_key }}{% if netfilter_mode | default('') %},extraArgs=--netfilter-mode={{ netfilter_mode }}{% endif %}"
+
+# 禁用组件
+disable:
+{% for component in k3s_disable_components %}
+  - {{ component }}
+{% endfor %}
+
+# 节点标签
+node-label:
+{% if node_region is defined %}
+  - "topology.kubernetes.io/region={{ node_region }}"
+{% endif %}
+{% if enable_lb is defined %}
+  - "svccontroller.k3s.cattle.io/enablelb={{ enable_lb | string | lower }}"
+{% endif %}
+{% if node_labels is defined %}
+{% for key, value in node_labels.items() %}
+  - "{{ key }}={{ value }}"
+{% endfor %}
+{% endif %}
+
@@ -0,0 +1,11 @@
+# 镜像加速配置
+---
+mirrors:
+{% for registry, endpoints in registry_mirrors.items() %}
+  "{{ registry }}":
+    endpoint:
+{% for endpoint in endpoints %}
+      - "https://{{ endpoint }}"
+{% endfor %}
+{% endfor %}
+
@@ -0,0 +1,51 @@
+# SSH 安全加固 Role
+# 功能: 修改端口、配置密钥认证、禁用密码登录
+---
+- name: Ensure .ssh directory exists
+  ansible.builtin.file:
+    path: /root/.ssh
+    state: directory
+    mode: '0700'
+
+- name: Add SSH public key
+  ansible.builtin.authorized_key:
+    user: root
+    key: "{{ ssh_pubkey }}"
+    state: present
+
+- name: Backup original sshd_config
+  ansible.builtin.copy:
+    src: /etc/ssh/sshd_config
+    dest: /etc/ssh/sshd_config.bak
+    remote_src: yes
+    force: no
+
+- name: Deploy secure sshd_config
+  ansible.builtin.template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    mode: '0600'
+    validate: '/usr/sbin/sshd -t -f %s'
+  register: sshd_config
+
+- name: Restart sshd service
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted
+  when: sshd_config.changed
+
+- name: Update ansible_port to new SSH port
+  ansible.builtin.set_fact:
+    ansible_port: "{{ ssh_new_port }}"
+  when: sshd_config.changed
+
+- name: Wait for SSH on new port
+  ansible.builtin.wait_for:
+    port: "{{ ssh_new_port }}"
+    host: "{{ ansible_host }}"
+    delay: 5
+    timeout: 60
+  delegate_to: localhost
+  become: no
+  when: sshd_config.changed
+
@@ -0,0 +1,12 @@
+# SSH 配置模板
+Port {{ ssh_new_port }}
+PermitRootLogin prohibit-password
+PasswordAuthentication no
+PubkeyAuthentication yes
+ChallengeResponseAuthentication no
+UsePAM yes
+X11Forwarding no
+PrintMotd no
+AcceptEnv LANG LC_*
+Subsystem sftp /usr/lib/openssh/sftp-server
+