158 lines
7.1 KiB
YAML
158 lines
7.1 KiB
YAML
---
|
|
# file: roles/incus/tasks/cluster.yml
|
|
|
|
- name: "set facts incus_cluster_main_ip"
|
|
ansible.builtin.set_fact:
|
|
incus_cluster_main_ip: "{{ hostvars[ovn_cluster_main_name]['incus_ip'] }}"
|
|
|
|
- name: "Set ovn_connection_type"
|
|
ansible.builtin.set_fact:
|
|
ovn_connection_type: "{{ ovn_ssl | ternary('ssl', 'tcp') }}"
|
|
|
|
- name: "set facts ovn_central bounds lists"
|
|
ansible.builtin.set_fact:
|
|
incus_ovn_northbound_list: "{{ (incus_ovn_northbound_list | default([])) + [ovn_connection_type + ':' + hostvars[item]['ovn_ip'] + ':6641'] }}"
|
|
loop: "{{ ovn_central_servers }}"
|
|
|
|
- name: "set facts ovn_central bounds"
|
|
ansible.builtin.set_fact:
|
|
incus_ovn_northbound: "{{ incus_ovn_northbound_list | join(',') }}"
|
|
|
|
- name: "set facts ovn_ic bounds lists"
|
|
ansible.builtin.set_fact:
|
|
incus_ovn_ic_northbound_list: "{{ (incus_ovn_ic_northbound_list | default([])) + [ovn_connection_type + ':' + hostvars[item]['ovn_ip'] + ':6645'] }}"
|
|
incus_ovn_ic_southbound_list: "{{ (incus_ovn_ic_southbound_list | default([])) + [ovn_connection_type + ':' + hostvars[item]['ovn_ip'] + ':6646'] }}"
|
|
loop: "{{ ovn_ic_db_servers }}"
|
|
when:
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "set facts ovn_ic bounds"
|
|
ansible.builtin.set_fact:
|
|
incus_ovn_ic_northbound: "{{ incus_ovn_ic_northbound_list | join(',') }}"
|
|
incus_ovn_ic_southbound: "{{ incus_ovn_ic_southbound_list | join(',') }}"
|
|
when:
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "Get {{ incus_cluster_name }} secrets from hashicorp vault"
|
|
ansible.builtin.set_fact:
|
|
incus_hv_secrets: "{{ lookup('community.hashi_vault.vault_kv2_get', 'group_vars/' + incus_cluster_name, engine_mount_point='talas-kv') }}"
|
|
when: ovn_ssl
|
|
|
|
- name: "Extract cert and private key from hashicorp vault"
|
|
ansible.builtin.set_fact:
|
|
incus_client_cert_serial_number: "{{ incus_hv_secrets.secret.ovn_cert_incus_client_serial_number }}"
|
|
incus_client_cert_private_key: "{{ incus_hv_secrets.secret.ovn_cert_incus_client_private_key }}"
|
|
when: ovn_ssl
|
|
|
|
- name: "Get client cert and issuing certificates from hashicorp vault pki"
|
|
ansible.builtin.set_fact:
|
|
incus_client_cert_issuing_ca_chain: "{{ lookup('community.hashi_vault.vault_read', 'pki/issuer/OVN') | community.general.json_query('data.ca_chain') | join() | trim }}"
|
|
incus_client_cert_ca: "{{ lookup('community.hashi_vault.vault_read', 'pki/cert/' + incus_client_cert_serial_number) | community.general.json_query('data.certificate') }}"
|
|
when: ovn_ssl
|
|
|
|
- name: "init preseed if first cluster main install"
|
|
ansible.builtin.shell:
|
|
cmd: /usr/bin/incus admin init --preseed
|
|
stdin: "{{ incus_cluster_main_init_yaml }}"
|
|
stdin_add_newline: true
|
|
when:
|
|
- incus_admin_init_dump.stdout == incus_yaml_unconfigured
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
# https://tracker.talas.com/browse/INFRA-179
|
|
#- name: "get and set OVN configuration WITH TLS"
|
|
# ansible.builtin.include_tasks: get_and_set.yml
|
|
# loop:
|
|
# - { section: config, key: network.ovn.northbound_connection, value: "{{ incus_cluster_ovn_conf.northbound_connection }}" }
|
|
# - { section: config, key: network.ovn.client_cert, value: "{{ incus_cluster_ovn_conf.client_cert }}" }
|
|
# - { section: config, key: network.ovn.client_key, value: "{{ incus_cluster_ovn_conf.client_key }}" }
|
|
# - { section: config, key: network.ovn.ca_cert, value: "{{ incus_cluster_ovn_conf.ca_cert }}" }
|
|
# when:
|
|
# - ovn_ssl
|
|
# - ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "check if ovn_ic_integration exists"
|
|
ansible.builtin.command: "/usr/bin/incus network integration show ovn_ic_integration"
|
|
register: get_ovn_ic_integration
|
|
changed_when: false
|
|
check_mode: false
|
|
failed_when: false
|
|
when:
|
|
- ovn_ssl
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "incus network integration create ovn_ic_integration"
|
|
ansible.builtin.command: "/usr/bin/incus network integration create ovn_ic_integration ovn"
|
|
when:
|
|
- ovn_ssl
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
- get_ovn_ic_integration.rc != 0
|
|
|
|
- name: "get and set OVN IC integration configuration WITH TLS"
|
|
ansible.builtin.include_tasks: get_and_set.yml
|
|
loop:
|
|
- { section: "network integration", object: ovn_ic_integration, key: ovn.northbound_connection, value: "{{ incus_ovn_ic_northbound }}" }
|
|
- { section: "network integration", object: ovn_ic_integration, key: ovn.southbound_connection, value: "{{ incus_ovn_ic_southbound }}" }
|
|
- { section: "network integration", object: ovn_ic_integration, key: ovn.ca_cert, value: "{{ incus_cluster_ovn_conf.ca_cert }}" }
|
|
- { section: "network integration", object: ovn_ic_integration, key: ovn.client_cert, value: "{{ incus_cluster_ovn_conf.client_cert }}" }
|
|
- { section: "network integration", object: ovn_ic_integration, key: ovn.client_key, value: "{{ incus_cluster_ovn_conf.client_key }}" }
|
|
when:
|
|
- ovn_ssl
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "get IC integration transit pattern"
|
|
ansible.builtin.shell: incus network integration get ovn_ic_integration ovn.transit.pattern
|
|
register: get_transit_pattern
|
|
changed_when: false
|
|
check_mode: false
|
|
when:
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "/usr/bin/incus network integration set ovn_ic_integration ovn.transit.pattern"
|
|
ansible.builtin.shell: "/usr/bin/incus network integration set ovn_ic_integration ovn.transit.pattern {% raw %}'ts-incus-{{ integrationName }}-{{ peerName }}'{% endraw %}"
|
|
when:
|
|
- ovn_ic_db_servers is defined
|
|
- ansible_hostname == incus_cluster_main_name
|
|
- get_transit_pattern.stdout != {% raw %}'ts-incus-{{ integrationName }}-{{ peerName }}'{% endraw %}
|
|
|
|
- name: "get and set OVN configuration WITHOUT TLS"
|
|
ansible.builtin.include_tasks: get_and_set.yml
|
|
loop:
|
|
- { section: config, key: "network.ovn.northbound_connection", value: "{{ incus_cluster_ovn_conf.northbound_connection }}" }
|
|
when:
|
|
- not ovn_ssl
|
|
- ansible_hostname == incus_cluster_main_name
|
|
|
|
- name: "Create join tokens"
|
|
throttle: 1
|
|
delegate_to: "{{ incus_cluster_main_name }}"
|
|
vars:
|
|
ansible_python_interpreter: "{{ hostvars[incus_cluster_main_name].ansible_python_interpreter | default('/usr/bin/python3') }}"
|
|
ansible.builtin.shell:
|
|
cmd: "incus --force-local --quiet cluster add {{ inventory_hostname }}"
|
|
register: incus_cluster_add
|
|
when:
|
|
- incus_admin_init_dump.stdout == incus_yaml_unconfigured
|
|
- ansible_hostname != incus_cluster_main_name
|
|
|
|
- name: "init preseed if first cluster secondary install"
|
|
ansible.builtin.shell:
|
|
cmd: /usr/bin/incus admin init --preseed
|
|
stdin: "{{ incus_cluster_init_yaml }}"
|
|
stdin_add_newline: true
|
|
throttle: 1
|
|
when:
|
|
- incus_admin_init_dump.stdout == incus_yaml_unconfigured
|
|
- ansible_hostname != incus_cluster_main_name
|
|
|
|
- name: "get and set scheduler.instance"
|
|
ansible.builtin.include_tasks: get_and_set_cluster.yml
|
|
loop:
|
|
- { key: 'scheduler.instance', value: "{{ incus_cluster_scheduler }}" }
|
|
when: incus_cluster_scheduler is defined
|