mirror of
https://github.com/PyratLabs/ansible-role-k3s
synced 2024-11-13 00:40:19 +01:00
e7c714424c
* Tidy up and refactoring of tasks
- `k3s_config_dir` derived from `k3s_config_file`, reused throughout the role
to allow for easy removal of "Rancher" references #73.
- `k3s_token_location` has moved to be in `k3s_config_dir`.
- Tasks for creating directories now looped to caputure configuration from
`k3s_server` and `k3s_agent` and ensure directories exist before k3s
starts, see #75.
- Server token collected directly from token file, not symlinked file
(node-token).
- `k3s_runtime_config` defined in `vars/` for validation and overwritten in
tasks for control plane and workers.
- Removed unused references to GitHub API.
* set_fact now uses FQCN
* re-pin molecule<3.2
* Command module now uses FQCN
* Added package checks for #72
* Reorder task files
- Docker tasks moved into a separate directory for ease of removal #67
- Bugfix: Control plane on alternate port didn't work.
- Validation tasks grouped
* Fix Fedora tests
* Add optional documentation links to validations steps #76
* Removed jmespath requirement
* Fix issue with data collection
* Release candidate
61 lines
2.3 KiB
YAML
61 lines
2.3 KiB
YAML
---
|
|
|
|
- name: Check if newuidmap is available
|
|
ansible.builtin.command: which newuidmap
|
|
failed_when: false
|
|
changed_when: false
|
|
register: k3s_check_newuidmap_installed
|
|
|
|
- name: Check if /proc/sys/kernel/unprivileged_userns_clone exists
|
|
ansible.builtin.stat:
|
|
path: /proc/sys/kernel/unprivileged_userns_clone
|
|
register: k3s_check_unprivileged_userns_exists
|
|
|
|
- name: Get the value of /proc/sys/kernel/unprivileged_userns_clone
|
|
ansible.builtin.slurp:
|
|
src: /proc/sys/kernel/unprivileged_userns_clone
|
|
register: k3s_get_unprivileged_userns_clone
|
|
when: k3s_check_unprivileged_userns_exists.stat.exists
|
|
|
|
- name: Set the value of k3s_get_unprivileged_userns_clone
|
|
ansible.builtin.set_fact:
|
|
k3s_get_unprivileged_userns_clone:
|
|
content: "MQo="
|
|
when: not k3s_check_unprivileged_userns_exists.stat.exists
|
|
|
|
- name: Get the value of /proc/sys/user/max_user_namespaces
|
|
ansible.builtin.slurp:
|
|
src: /proc/sys/user/max_user_namespaces
|
|
register: k3s_get_max_user_namespaces
|
|
|
|
- name: Get the contents of /etc/subuid
|
|
ansible.builtin.slurp:
|
|
src: /etc/subuid
|
|
register: k3s_get_subuid
|
|
|
|
- name: Get the contents of /etc/subgid
|
|
ansible.builtin.slurp:
|
|
src: /etc/subgid
|
|
register: k3s_get_subgid
|
|
|
|
- name: Get current user subuid and subgid values
|
|
ansible.builtin.set_fact:
|
|
k3s_current_user_subuid: "{{ (k3s_get_subuid['content'] | b64decode).split('\n')
|
|
| select('search', ansible_user_id) | first | default('UserNotFound:0:0') }}"
|
|
k3s_current_user_subgid: "{{ (k3s_get_subgid['content'] | b64decode).split('\n')
|
|
| select('search', ansible_user_id) | first | default('UserNotFound:0:0') }}"
|
|
|
|
- name: Check user namespaces kernel parameters are adequate
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_get_unprivileged_userns_clone['content'] | b64decode | int == 1
|
|
- k3s_get_max_user_namespaces['content'] | b64decode | int >= 28633
|
|
- k3s_current_user_subuid != "UserNotFound:0:0"
|
|
- k3s_current_user_subgid != "UserNotFound:0:0"
|
|
- k3s_current_user_subuid.split(':')[2] | int >= 65536
|
|
- k3s_current_user_subgid.split(':')[2] | int >= 65536
|
|
- ansible_env['XDG_RUNTIME_DIR'] is defined
|
|
- k3s_check_newuidmap_installed.rc == 0
|
|
success_msg: All kernel parameters passed
|
|
fail_msg: Kernel parameters are not set correctly, please check
|
|
https://github.com/rootless-containers/rootlesskit
|