Ansible ile Sistem Hazırlığı

🗒️ Saha notu — ham komut/konfigürasyon dökümü. Olduğu gibi korunmuştur; kendi ortamına uyarla.

cd /root/k8s-production
mkdir -p ansible/inventory

cat > ansible/inventory/production.yml << 'EOF'
all:
  children:
    masters:
      hosts:
        k8s-master-1:
          ansible_host: <K8S_MASTER_1_IP>
          etcd_member_name: master1
        k8s-master-2:
          ansible_host: <K8S_MASTER_2_IP>
          etcd_member_name: master2
        k8s-master-3:
          ansible_host: <K8S_MASTER_3_IP>
          etcd_member_name: master3

    workers:
      hosts:
        k8s-worker-1:
          ansible_host: <K8S_WORKER_1_IP>
          node_labels: "workload-type=applications"
        k8s-worker-2:
          ansible_host: <K8S_WORKER_2_IP>
          node_labels: "workload-type=applications"
        k8s-worker-3:
          ansible_host: <K8S_WORKER_3_IP>
          node_labels: "workload-type=applications"

    infrastructure:
      hosts:
        k8s-infra-1:
          ansible_host: <K8S_INFRA_1_IP>
          node_labels: "workload-type=elk"
          node_taints: "workload=elk:NoSchedule"
        k8s-infra-2:
          ansible_host: <K8S_INFRA_2_IP>
          node_labels: "workload-type=monitoring"
          node_taints: "workload=monitoring:NoSchedule"
        k8s-infra-3:
          ansible_host: <K8S_INFRA_3_IP>
          node_labels: "workload-type=cicd"
          node_taints: "workload=cicd:NoSchedule"
        k8s-infra-4:
          ansible_host: <K8S_INFRA_4_IP>
          node_labels: "workload-type=ingress"
          node_taints: "workload=ingress:NoSchedule"

    loadbalancer:
      hosts:
        k8s-lb-1:
          ansible_host: <K8S_LB_VIP>
          lb_priority: 100
        k8s-lb-2:
          ansible_host: <K8S_LB_BACKUP_IP>
          lb_priority: 90

    storage:
      hosts:
        k8s-storage:
          ansible_host: <K8S_STORAGE_IP>

  vars:
    ansible_user: ubuntu
    ansible_ssh_private_key_file: ~/.ssh/k8s-cluster
    kubernetes_version: "1.30"
    pod_network_cidr: "10.244.0.0/16"
    service_subnet: "10.96.0.0/12"
    cluster_name: "production-k8s"
    api_server_endpoint: "<K8S_LB_VIP>:6443"
EOF


cd /root/k8s-production/ansible

# Ansible connectivity test
ansible all -i inventory/production.yml -m ping

# System preparation playbook oluştur
mkdir -p playbooks

cat > playbooks/01-system-prep.yml << 'EOF'
---
- name: System Preparation for Kubernetes
  hosts: all
  become: yes
  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600

    - name: Install basic packages
      apt:
        name:
          - curl
          - wget
          - gnupg
          - lsb-release
          - apt-transport-https
          - ca-certificates
          - software-properties-common
          - nfs-common
          - vim
          - htop
        state: present

    - name: Disable swap permanently
      shell: |
        swapoff -a
        sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

    - name: Load kernel modules
      modprobe:
        name: "{{ item }}"
      loop:
        - overlay
        - br_netfilter

    - name: Make kernel modules persistent
      copy:
        content: |
          overlay
          br_netfilter
        dest: /etc/modules-load.d/k8s.conf

    - name: Configure sysctl for Kubernetes
      copy:
        content: |
          net.bridge.bridge-nf-call-iptables  = 1
          net.bridge.bridge-nf-call-ip6tables = 1
          net.ipv4.ip_forward                 = 1
        dest: /etc/sysctl.d/k8s.conf
      notify: reload sysctl

    - name: Update /etc/hosts with all cluster nodes
      lineinfile:
        path: /etc/hosts
        line: "{{ hostvars[item]['ansible_host'] }} {{ item }}"
      loop: "{{ groups['all'] }}"

  handlers:
    - name: reload sysctl
      command: sysctl --system
EOF

ansible all -i inventory/production.yml -m ping

ansible-playbook -i inventory/production.yml playbooks/01-system-prep.yml

# Docker & Containerd installation playbook
cat > playbooks/02-container-runtime.yml << 'EOF'
---
- name: Install Container Runtime
  hosts: masters:workers:infrastructure
  become: yes
  tasks:
    - name: Install prerequisite packages
      apt:
        name:
          - apt-transport-https
          - ca-certificates
          - curl
          - gnupg
          - lsb-release
        update_cache: yes

    - name: Create keyring directory
      file:
        path: /etc/apt/keyrings
        state: directory
        mode: '0755'

    - name: Add Docker GPG key
      apt_key:
        url: https://download.docker.com/linux/ubuntu/gpg
        keyring: /etc/apt/keyrings/docker.gpg

    - name: Add Docker repository
      apt_repository:
        repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
        update_cache: yes

    - name: Install Docker packages
      apt:
        name:
          - docker-ce
          - docker-ce-cli
          - containerd.io
        state: present

    - name: Add ubuntu user to docker group
      user:
        name: ubuntu
        groups: docker
        append: yes

    - name: Create containerd config directory
      file:
        path: /etc/containerd
        state: directory

    - name: Generate containerd configuration
      shell: containerd config default > /etc/containerd/config.toml

    - name: Configure systemd cgroup driver
      replace:
        path: /etc/containerd/config.toml
        regexp: 'SystemdCgroup = false'
        replace: 'SystemdCgroup = true'

    - name: Start and enable containerd
      systemd:
        name: containerd
        state: restarted
        enabled: yes

    - name: Start and enable docker
      systemd:
        name: docker
        state: started
        enabled: yes

    - name: Verify docker installation
      command: docker --version
      register: docker_version

    - name: Display docker version
      debug:
        msg: "Docker version: {{ docker_version.stdout }}"
EOF

# Container runtime kurulumunu çalıştır
ansible-playbook -i inventory/production.yml playbooks/02-container-runtime.yml

# Kubernetes packages installation playbook
cat > playbooks/03-kubernetes-packages.yml << 'EOF'
---
- name: Install Kubernetes packages
  hosts: masters:workers:infrastructure
  become: yes
  tasks:
    - name: Create Kubernetes keyring directory
      file:
        path: /etc/apt/keyrings
        state: directory
        mode: '0755'

    - name: Add Kubernetes GPG key
      apt_key:
        url: https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key
        keyring: /etc/apt/keyrings/kubernetes-apt-keyring.gpg

    - name: Add Kubernetes repository
      apt_repository:
        repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /"
        update_cache: yes

    - name: Install Kubernetes packages
      apt:
        name:
          - kubelet
          - kubeadm
          - kubectl
        state: present
        update_cache: yes

    - name: Hold Kubernetes packages from auto-update
      dpkg_selections:
        name: "{{ item }}"
        selection: hold
      loop:
        - kubelet
        - kubeadm
        - kubectl

    - name: Enable and start kubelet
      systemd:
        name: kubelet
        enabled: yes
        state: started
      ignore_errors: yes  # kubelet will fail until cluster is initialized

    - name: Verify kubeadm version
      command: kubeadm version -o short
      register: kubeadm_version

    - name: Display kubeadm version
      debug:
        msg: "Kubeadm version: {{ kubeadm_version.stdout }}"
EOF

# Kubernetes packages kurulumunu çalıştır
ansible-playbook -i inventory/production.yml playbooks/03-kubernetes-packages.yml

# HAProxy load balancer setup
cat > playbooks/04-load-balancer.yml << 'EOF'
---
- name: Setup HAProxy Load Balancer
  hosts: loadbalancer
  become: yes
  tasks:
    - name: Install HAProxy and Keepalived
      apt:
        name:
          - haproxy
          - keepalived
        update_cache: yes

    - name: Configure HAProxy
      copy:
        content: |
          global
              log stdout local0
              chroot /var/lib/haproxy
              stats socket /run/haproxy/admin.sock mode 660 level admin
              stats timeout 30s
              user haproxy
              group haproxy
              daemon

          defaults
              mode http
              log global
              option httplog
              option dontlognull
              option log-health-checks
              option forwardfor
              option http-server-close
              timeout connect 5000
              timeout client 50000
              timeout server 50000

          frontend stats
              bind *:8404
              stats enable
              stats uri /stats
              stats refresh 30s

          frontend k8s_api_frontend
              bind *:6443
              mode tcp
              option tcplog
              default_backend k8s_api_backend

          backend k8s_api_backend
              mode tcp
              balance roundrobin
              option tcp-check
              server master1 <K8S_MASTER_1_IP>:6443 check fall 3 rise 2
              server master2 <K8S_MASTER_2_IP>:6443 check fall 3 rise 2
              server master3 <K8S_MASTER_3_IP>:6443 check fall 3 rise 2

          frontend k8s_ingress_http
              bind *:80
              mode http
              default_backend k8s_ingress_http_backend

          backend k8s_ingress_http_backend
              mode http
              balance roundrobin
              server ingress1 <K8S_INFRA_4_IP>:80 check

          frontend k8s_ingress_https
              bind *:443
              mode tcp
              default_backend k8s_ingress_https_backend

          backend k8s_ingress_https_backend
              mode tcp
              balance roundrobin
              server ingress1 <K8S_INFRA_4_IP>:443 check
        dest: /etc/haproxy/haproxy.cfg
        backup: yes

    - name: Restart and enable HAProxy
      systemd:
        name: haproxy
        state: restarted
        enabled: yes

    - name: Verify HAProxy status
      command: systemctl is-active haproxy
      register: haproxy_status

    - name: Display HAProxy status
      debug:
        msg: "HAProxy status: {{ haproxy_status.stdout }}"
EOF

ansible-playbook -i inventory/production.yml playbooks/04-load-balancer.yml