pb_scale.yaml

---

- hosts: all
  tasks:
    - set_fact:
        unsafe_show_logs: "{{ not (kuboardspray_no_log | default(true)) }}"

# 由于始终通过镜像分发，因此我们不检查 ansible_version
# - name: Check ansible version
#   import_playbook: 3rd/kubespray/ansible_version.yml

# - name: Ensure compatibility with old groups
#   import_playbook: legacy_groups.yml

- name: Disable firewalld
  hosts: "{{ node }}"
  roles:
    - { role: os-services/roles/prepare }

- name: Config apt-sources / yum-repo
  hosts: "{{ node }}"
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  roles:
    - { role: config-apt-sources }
    - { role: config-yum-repo }
    - { role: kubespray-defaults }
    - { role: configure-docker-repo, when: container_manager == 'docker' }


- name: Bootstrap any new workers
  hosts: "{{ node }}"
  strategy: linear
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  gather_facts: false
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: bootstrap-os, tags: bootstrap-os }
    - { role: deploy-kube-bench, tags: download, when: "not skip_downloads" }

- name: Gather facts
  hosts: kube_control_plane,{{node}}
  any_errors_fatal: true
  roles:
    - { role: kuboard-spray-facts }
    - { role: kubespray-defaults }

# - name: Generate the etcd certificates beforehand
#   hosts: etcd
#   gather_facts: False
#   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
#   environment: "{{ proxy_disable_env }}"
#   roles:
#     - { role: kubespray-defaults }
#     - { role: etcd, tags: etcd, etcd_cluster_setup: false }

# - name: Download images to ansible host cache via first kube_control_plane node
#   hosts: kube_control_plane[0]
#   gather_facts: False
#   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
#   environment: "{{ proxy_disable_env }}"
#   roles:
#     - { role: kubespray-defaults, when: "not skip_downloads and download_run_once and not download_localhost" }
#     - { role: kubernetes/preinstall, tags: preinstall, when: "not skip_downloads and download_run_once and not download_localhost" }
#     - { role: download, tags: download, when: "not skip_downloads and download_run_once and not download_localhost" }

- name: Target only workers to get kubelet installed and checking in on any new nodes(engine)
  hosts: "{{ node }}"
  gather_facts: False
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: kubernetes/preinstall, tags: preinstall }
    - { role: container-engine, tags: "container-engine", when: deploy_container_engine }
    - { role: download, tags: download, when: "not skip_downloads" }
    # - { role: etcd, tags: etcd, etcd_cluster_setup: false, when: "not etcd_kubeadm_enabled|default(false)" }
    - role: etcd
      tags: etcd
      etcd_cluster_setup: false
      when:
        - "etcd_deployment_type != 'kubeadm'"
        - inventory_hostname in groups['etcd']
  vars:
    kubeadm_images:
      kubeadm_kube-proxy:
        enabled: true
        container: true
        repo: "{{ kube_image_repo }}/kube-proxy"
        tag: "{{ kube_version }}"
        groups: "k8s_cluster"


- name: Target only workers to get kubelet installed and checking in on any new nodes(node)
  hosts: "{{ node }}"
  gather_facts: False
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: kubernetes/node, tags: node }

- name: Upload control plane certs and retrieve encryption key
  hosts: kube_control_plane | first
  environment: "{{ proxy_disable_env }}"
  gather_facts: False
  tags: kubeadm
  roles:
    - { role: kubespray-defaults }
  tasks:
    - name: Upload control plane certificates
      command: >-
        {{ bin_dir }}/kubeadm init phase
        --config {{ kube_config_dir }}/kubeadm-config.yaml
        upload-certs
        --upload-certs
      environment: "{{ proxy_disable_env }}"
      register: kubeadm_upload_cert
      changed_when: false
    - name: set fact 'kubeadm_certificate_key' for later use
      set_fact:
        kubeadm_certificate_key: "{{ kubeadm_upload_cert.stdout_lines[-1] | trim }}"
      when: kubeadm_certificate_key is not defined

- name: Target only workers to get kubelet installed and checking in on any new nodes(network)
  hosts: "{{ node }}"
  gather_facts: False
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: kubernetes/kubeadm, tags: kubeadm }
    - { role: kubernetes/node-label, tags: node-label }
    - { role: network_plugin, tags: network }

- name: Apply resolv.conf changes now that cluster DNS is up
  hosts: k8s_cluster
  gather_facts: False
  any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
  environment: "{{ proxy_disable_env }}"
  roles:
    - { role: kubespray-defaults }
    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }