feat: Add HA Kubernetes cluster with Terraform + Ansible
- 3x CX23 control plane nodes (HA) - 4x CX33 worker nodes - k3s with embedded etcd - Hetzner CCM for load balancers - Gitea CI/CD workflows - Backblaze B2 for Terraform state
This commit is contained in:
95
.gitea/workflows/ansible.yml
Normal file
95
.gitea/workflows/ansible.yml
Normal file
@@ -0,0 +1,95 @@
|
||||
name: Ansible
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Terraform"]
|
||||
types:
|
||||
- completed
|
||||
branches:
|
||||
- main
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tags:
|
||||
description: 'Ansible tags to run'
|
||||
required: false
|
||||
default: ''
|
||||
|
||||
env:
|
||||
ANSIBLE_VERSION: "2.16"
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
name: Deploy Cluster
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event.workflow_run.conclusion == 'success' }} || github.event_name == 'workflow_dispatch'
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Download Terraform Outputs
|
||||
if: github.event_name != 'workflow_dispatch'
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: terraform-outputs
|
||||
path: outputs/
|
||||
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: '3.11'
|
||||
|
||||
- name: Install Ansible
|
||||
run: |
|
||||
pip install ansible==${{ env.ANSIBLE_VERSION }}.*
|
||||
pip install jinja2 pyyaml kubernetes
|
||||
|
||||
- name: Setup SSH Key
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
ssh-keyscan -H ${{ secrets.CONTROL_PLANE_IP }} >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
|
||||
- name: Generate Ansible Inventory
|
||||
working-directory: ansible
|
||||
run: |
|
||||
python3 generate_inventory.py
|
||||
env:
|
||||
TF_VAR_hcloud_token: ${{ secrets.HCLOUD_TOKEN }}
|
||||
|
||||
- name: Run Ansible Playbook
|
||||
working-directory: ansible
|
||||
run: |
|
||||
ansible-playbook site.yml \
|
||||
${{ github.event.inputs.tags != '' && format('-t {0}', github.event.inputs.tags) || '' }} \
|
||||
-e "hcloud_token=${{ secrets.HCLOUD_TOKEN }}" \
|
||||
-e "cluster_name=k8s-cluster"
|
||||
env:
|
||||
ANSIBLE_HOST_KEY_CHECKING: "False"
|
||||
|
||||
- name: Upload Kubeconfig
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: kubeconfig
|
||||
path: outputs/kubeconfig
|
||||
|
||||
verify:
|
||||
name: Verify Cluster
|
||||
runs-on: ubuntu-latest
|
||||
needs: deploy
|
||||
steps:
|
||||
- name: Download Kubeconfig
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: kubeconfig
|
||||
|
||||
- name: Setup kubectl
|
||||
uses: azure/setup-kubectl@v3
|
||||
with:
|
||||
version: 'v1.30.0'
|
||||
|
||||
- name: Verify Cluster
|
||||
run: |
|
||||
export KUBECONFIG=$(pwd)/kubeconfig
|
||||
kubectl get nodes
|
||||
kubectl get pods -A
|
||||
49
.gitea/workflows/destroy.yml
Normal file
49
.gitea/workflows/destroy.yml
Normal file
@@ -0,0 +1,49 @@
|
||||
name: Destroy
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
confirm:
|
||||
description: 'Type "destroy" to confirm'
|
||||
required: true
|
||||
default: ''
|
||||
|
||||
env:
|
||||
TF_VERSION: "1.7.0"
|
||||
|
||||
jobs:
|
||||
destroy:
|
||||
name: Destroy Cluster
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event.inputs.confirm == 'destroy'
|
||||
environment: destroy
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Terraform
|
||||
uses: hashicorp/setup-terraform@v3
|
||||
with:
|
||||
terraform_version: ${{ env.TF_VERSION }}
|
||||
|
||||
- name: Terraform Init
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform init \
|
||||
-backend-config="endpoint=${{ secrets.S3_ENDPOINT }}" \
|
||||
-backend-config="bucket=${{ secrets.S3_BUCKET }}" \
|
||||
-backend-config="region=auto" \
|
||||
-backend-config="access_key=${{ secrets.S3_ACCESS_KEY }}" \
|
||||
-backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}"
|
||||
|
||||
- name: Terraform Destroy
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform destroy \
|
||||
-var="hcloud_token=${{ secrets.HCLOUD_TOKEN }}" \
|
||||
-var="ssh_public_key=${{ secrets.SSH_PUBLIC_KEY }}" \
|
||||
-var="ssh_private_key=${{ secrets.SSH_PRIVATE_KEY }}" \
|
||||
-var="s3_access_key=${{ secrets.S3_ACCESS_KEY }}" \
|
||||
-var="s3_secret_key=${{ secrets.S3_SECRET_KEY }}" \
|
||||
-var="s3_endpoint=${{ secrets.S3_ENDPOINT }}" \
|
||||
-auto-approve
|
||||
149
.gitea/workflows/terraform.yml
Normal file
149
.gitea/workflows/terraform.yml
Normal file
@@ -0,0 +1,149 @@
|
||||
name: Terraform
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'terraform/**'
|
||||
- '.gitea/workflows/terraform.yml'
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'terraform/**'
|
||||
- '.gitea/workflows/terraform.yml'
|
||||
|
||||
env:
|
||||
TF_VERSION: "1.7.0"
|
||||
TF_VAR_hcloud_token: ${{ secrets.HCLOUD_TOKEN }}
|
||||
TF_VAR_s3_access_key: ${{ secrets.S3_ACCESS_KEY }}
|
||||
TF_VAR_s3_secret_key: ${{ secrets.S3_SECRET_KEY }}
|
||||
|
||||
jobs:
|
||||
validate:
|
||||
name: Validate
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Terraform
|
||||
uses: hashicorp/setup-terraform@v3
|
||||
with:
|
||||
terraform_version: ${{ env.TF_VERSION }}
|
||||
|
||||
- name: Terraform Format Check
|
||||
working-directory: terraform
|
||||
run: terraform fmt -check -recursive
|
||||
|
||||
- name: Terraform Init
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform init \
|
||||
-backend-config="endpoint=${{ secrets.S3_ENDPOINT }}" \
|
||||
-backend-config="bucket=${{ secrets.S3_BUCKET }}" \
|
||||
-backend-config="region=auto" \
|
||||
-backend-config="access_key=${{ secrets.S3_ACCESS_KEY }}" \
|
||||
-backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}"
|
||||
|
||||
- name: Terraform Validate
|
||||
working-directory: terraform
|
||||
run: terraform validate
|
||||
|
||||
plan:
|
||||
name: Plan
|
||||
runs-on: ubuntu-latest
|
||||
needs: validate
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Terraform
|
||||
uses: hashicorp/setup-terraform@v3
|
||||
with:
|
||||
terraform_version: ${{ env.TF_VERSION }}
|
||||
|
||||
- name: Terraform Init
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform init \
|
||||
-backend-config="endpoint=${{ secrets.S3_ENDPOINT }}" \
|
||||
-backend-config="bucket=${{ secrets.S3_BUCKET }}" \
|
||||
-backend-config="region=auto" \
|
||||
-backend-config="access_key=${{ secrets.S3_ACCESS_KEY }}" \
|
||||
-backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}"
|
||||
|
||||
- name: Terraform Plan
|
||||
id: plan
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform plan \
|
||||
-var="ssh_public_key=${{ secrets.SSH_PUBLIC_KEY }}" \
|
||||
-var="ssh_private_key=${{ secrets.SSH_PRIVATE_KEY }}" \
|
||||
-out=tfplan \
|
||||
-no-color
|
||||
continue-on-error: true
|
||||
|
||||
- name: Post Plan to PR
|
||||
if: github.event_name == 'pull_request'
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const output = `#### Terraform Plan
|
||||
\`\`\`
|
||||
${{ steps.plan.outputs.stdout }}
|
||||
\`\`\``;
|
||||
github.rest.issues.createComment({
|
||||
issue_number: context.issue.number,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
body: output
|
||||
});
|
||||
|
||||
- name: Fail if plan failed
|
||||
if: steps.plan.outcome == 'failure'
|
||||
run: exit 1
|
||||
|
||||
apply:
|
||||
name: Apply
|
||||
runs-on: ubuntu-latest
|
||||
needs: plan
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
environment: production
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Terraform
|
||||
uses: hashicorp/setup-terraform@v3
|
||||
with:
|
||||
terraform_version: ${{ env.TF_VERSION }}
|
||||
|
||||
- name: Terraform Init
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform init \
|
||||
-backend-config="endpoint=${{ secrets.S3_ENDPOINT }}" \
|
||||
-backend-config="bucket=${{ secrets.S3_BUCKET }}" \
|
||||
-backend-config="region=auto" \
|
||||
-backend-config="access_key=${{ secrets.S3_ACCESS_KEY }}" \
|
||||
-backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}"
|
||||
|
||||
- name: Terraform Apply
|
||||
working-directory: terraform
|
||||
run: |
|
||||
terraform apply \
|
||||
-var="ssh_public_key=${{ secrets.SSH_PUBLIC_KEY }}" \
|
||||
-var="ssh_private_key=${{ secrets.SSH_PRIVATE_KEY }}" \
|
||||
-auto-approve
|
||||
|
||||
- name: Save Terraform Outputs
|
||||
working-directory: terraform
|
||||
run: terraform output -json > ../outputs/terraform_outputs.json
|
||||
|
||||
- name: Upload Outputs
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: terraform-outputs
|
||||
path: outputs/terraform_outputs.json
|
||||
Reference in New Issue
Block a user