Playbooks to configure OpenShift 4.x cluster

Couple of ansible roles to configure serveral components for a fresh install of an openshift cluster.

Important

None of these role are written to be used blindly. They are provided as a POC/minimum viable option to get you kickstarted without having to put a ton of effort to figure out exactly what all needs to be done.

A lot of assumptions are made. So please walk through the roles first, before attempting to run them.

Setting up your environment to run the playbooks

REQUIREMENTS:

 - python3
 - python modules for ansible: openshift kubernetes
 - access to the openshift API with a cluster-admin account

Note	if access to download python pip packages is blocked uncompress file k8s-ocp-deps.tar.gz in the home dir of the user running these plays

tar xzvf k8s-ocp-deps.tar.gz ~/

RHEL7

Assuming that you are running as a non root user. Adjust accordingly

sudo yum install ansible
sudo yum install python3.x86_64 python3-pip.noarch libselinux-python3.x86_64
pip3 install --user openshift kubernetes

Runing the individual roles

You can run individual roles by runnning ansible playbook against the roles/<role-name>/apply/main.yaml playbook in each of the individual roles.

ansible-playbook roles/<role-name>/apply/main.yaml

Install roles

1. Prepare the bastion node (ocp4 clients, httpd)

ansible-playbook roles/prepare-bastion/apply/main.yaml

1. Prepare install-config, and manifests, ignition files

ansible-playbook roles/prepare-install/apply/main.yaml --vault-password-file .vault_secret

Below are the list of ansible roles that are available. Do checkout the individual role’s documenation for more information on what they do.

List of Day2 Roles

roles/
├── api-tls-cert
├── cluster-monitoring
├── cluster-logging
├── etcd-backup
├── image-registry
├── ingress-tls-cert
├── ldap-group-sync
├── ldap-oauth
├── project-template
├── self-provisioner
└── setup-infra

1. Authenticate with oc client to cluster API This ansible role requires that you are have an authenticated kubectl/oc session which has sufficient previlegges to create namespaces, and install operators.

oc login -u <cluster-admin-user> https://api.yourdomain.com

Warning

Make sure you are in the ansible directory of this repo before you these playbooks

git clone https://THIS_REPO
cd THIS_REPO

1. Convert worker nodes to infra

ansible-playbook roles/setup-infra/apply/main.yaml

1. Update infra TLS certificate and Key and move pods to infra nodes

ansible-playbook roles/ingress-tls-cert/apply/main.yaml --vault-password-file .vault_secret

1. Apply default project request template

ansible-playbook roles/project-template/apply/main.yaml

1. Activate, Update Image Registry and move pods to infra nodes

ansible-playbook roles/image-registry/apply/main.yaml

1. Move cluster monitoring resources to infra nodes

ansible-playbook roles/cluster-monitoring/apply/main.yaml

1. Setup EFK stack

ansible-playbook roles/cluster-logging/apply/main.yaml

1. Integrate LDAP authentication

ansible-playbook roles/ldap-oauth/apply/main.yaml --vault-password-file .vault_secret

1. Integrate LDAP group synchronization

ansible-playbook roles/ldap-group-sync/apply/main.yaml --vault-password-file .vault_secret

1. Remove Self Provisioners Rolebinding

ansible-playbook roles/self-provisioner/apply/main.yaml

1. Update API TLS certificate and enable etcd encryption

ansible-playbook roles/api-tls-cert/apply/main.yaml --vault-password-file .vault_secret

1. Assign cluster roles to ldap groups and remove kubeadmin

ansible-playbook roles/cluster-roles/apply/main.yaml

1. Setup ETCD backups

ansible-playbook setup-etcd-backup.yaml

Note	if you want to perform an etcd backup run: ansible-playbook roles/etcd-backups/apply/main.yaml

Run All base roles!

ansible-playbook day2-common.yaml --vault-password-file .vault_secret
ansible-playbook setup-etcd-backup.yaml

Override variables for a role or run all

ansible-playbook roles/ROLE_NAME/apply/main.yaml
or
ansible-playbook day2-common.yaml --vault-password-file .vault_secret

Important

After running the playbook 12 (cluster-roles), you need to login with your LDAP creds perform the following steps to clean old references to kubeadmin and old api certs

rm -rf ~/.kube
unset KUBECONFIG
oc login https://api.REPLACE-ENV.example.com:6443 -u YOUR_USER