Add Gitea;Allow override of helm-chart basedir

.drone.yml

@@ -14,11 +14,11 @@ steps:
 - name: Debugging information
   image: bv11-cr01.bessems.eu/library/packer-extended
   commands:
-  - yamllint --version
-  - packer --version
   - ansible --version
   - ovftool --version
-- name: Ubuntu Server 22.04
+  - packer --version
+  - yamllint --version
+- name: Kubernetes Bootstrap Appliance
   image: bv11-cr01.bessems.eu/library/packer-extended
   pull: always
   commands:
@@ -30,13 +30,16 @@ steps:
       ansible \
       packer/preseed/UbuntuServer22.04/user-data \
       scripts
+  - |
+    ansible-galaxy install \
+      -r ansible/requirements.yml
   - |
     packer init -upgrade \
       ./packer
   - |
     packer validate \
       -var vm_name=$DRONE_BUILD_NUMBER-${DRONE_COMMIT_SHA:0:10} \
-      -var vm_guestos=ubuntuserver22.04 \
+      -var vm_guestos=k8sbootstrap \
       -var repo_username=$${REPO_USERNAME} \
       -var repo_password=$${REPO_PASSWORD} \
       -var vsphere_password=$${VSPHERE_PASSWORD} \
@@ -46,7 +49,7 @@ steps:
     packer build \
       -on-error=cleanup -timestamp-ui \
       -var vm_name=$DRONE_BUILD_NUMBER-${DRONE_COMMIT_SHA:0:10} \
-      -var vm_guestos=ubuntuserver22.04 \
+      -var vm_guestos=k8sbootstrap \
       -var repo_username=$${REPO_USERNAME} \
       -var repo_password=$${REPO_PASSWORD} \
       -var vsphere_password=$${VSPHERE_PASSWORD} \

README.md

@@ -1 +1 @@
-# Packer.Images [![Build Status](https://ci.spamasaurus.com/api/badges/djpbessems/Packer.Images/status.svg?ref=refs/heads/UbuntuServer22.04)](https://ci.spamasaurus.com/djpbessems/Packer.Images)
+# Packer.Images [![Build Status](https://ci.spamasaurus.com/api/badges/djpbessems/Packer.Images/status.svg?ref=refs/heads/Kubernetes.Bootstrap.Appliance)](https://ci.spamasaurus.com/djpbessems/Packer.Images)

ansible/playbook.yml

@@ -1,7 +1,11 @@
 ---
 - hosts: all
   gather_facts: false
+  vars_files:
+    - metacluster.yml
   become: true
   roles:
     - os
     - firstboot
+    - appliance
+    - metacluster

ansible/requirements.yml

@@ -0,0 +1,4 @@
+collections:
+  - ansible.utils
+  - community.general
+  - kubernetes.core

ansible/roles/appliance/tasks/dependencies.archive_compressed.yml

@@ -0,0 +1,27 @@
+---
+- name: Initialize tempfolder
+  ansible.builtin.tempfile:
+    state: directory
+  register: archive
+
+- name: Download & extract archived static binary
+  ansible.builtin.unarchive:
+    src: "{{ item.url }}"
+    dest: "{{ archive.path }}"
+    remote_src: yes
+    extra_opts: "{{ item.extra_opts | default(omit) }}"
+
+- name: Install extracted binary
+  ansible.builtin.copy:
+    src: "{{ archive.path }}/{{ item.filename }}"
+    dest: /usr/local/bin/{{ item.filename }}
+    remote_src: yes
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Cleanup tempfolder
+  ansible.builtin.file:
+    path: "{{ archive.path }}"
+    state: absent
+  when: archive.path is defined

ansible/roles/appliance/tasks/dependencies.yml

@@ -0,0 +1,46 @@
+# - name: Create folder structure(s)
+#  ansible.builtin.file:
+#    path: "{{ item }}"
+#    state: directory
+#  loop:
+#    - /foo
+
+- name: Download & install static binaries
+  ansible.builtin.get_url:
+    url: "{{ item.url }}"
+    dest: /usr/local/bin/{{ item.filename }}
+    owner: root
+    group: root
+    mode: 0755
+  loop: "{{ dependencies.static_binaries | selectattr('archive', 'undefined') }}"
+  loop_control:
+    label: "{{ item.filename }}"
+
+- name: Download, extract & install archived static binaries
+  include_tasks: dependencies.archive_compressed.yml
+  loop: "{{ dependencies.static_binaries | rejectattr('archive', 'undefined') | selectattr('archive', 'equalto', 'compressed') }}"
+  loop_control:
+    label: "{{ item.filename }}"
+
+- name: Install ansible-galaxy collections
+  ansible.builtin.shell:
+    cmd: ansible-galaxy collection install {{ item }}
+  loop: "{{ dependencies.ansible_galaxy_collections }}"
+
+- name: Install distro packages
+  ansible.builtin.apt:
+    pkg: "{{ dependencies.packages }}"
+    state: latest
+    update_cache: yes
+    install_recommends: no
+
+- name: Upgrade all packages
+  ansible.builtin.apt:
+    name: '*'
+    state: latest
+    update_cache: yes
+
+- name: Cleanup apt cache
+  ansible.builtin.apt:
+    autoremove: yes
+    purge: yes

ansible/roles/appliance/tasks/main.yml

@@ -0,0 +1,2 @@
+- name: Install & configure dependencies
+  import_tasks: dependencies.yml

ansible/roles/firstboot/files/ansible_payload/playbook.yml

@@ -7,4 +7,5 @@
     - vapp
     - network
     - users
+    - metacluster
     - cleanup

ansible/roles/firstboot/files/ansible_payload/roles/metacluster/tasks/main.yml

@@ -0,0 +1,66 @@
+- name: Install K3s
+  ansible.builtin.command:
+    cmd: ./install.sh
+    chdir: /opt/metacluster/k3s
+  environment:
+    INSTALL_K3S_SKIP_DOWNLOAD: 'true'
+    INSTALL_K3S_EXEC: 'server --cluster-init'
+
+- name: Ensure API availability
+  ansible.utils.cli_parse:
+    command: curl -k https://{{ vapp['guestinfo.ipaddress'] }}:6443/livez?verbose
+    parser:
+      name: ansible.utils.json
+    set_fact: api_readycheck
+  ignore_errors: yes
+  until: api_readycheck.apiVersion is defined
+  retries: 3
+  delay: 30
+
+- block:
+
+    - name: Initialize tempfile
+      ansible.builtin.tempfile:
+        state: file
+      register: kubeconfig
+
+    - name: Retrieve kubeconfig
+      ansible.builtin.command:
+        cmd: kubectl config view --raw
+      register: kubectl_config
+
+    - name: Store kubeconfig in tempfile
+      ansible.builtin.copy:
+        dest: "{{ kubeconfig.path }}"
+        content: "{{ kubectl_config.stdout }}"
+        mode: 0600
+      no_log: true
+
+- block:
+
+    - name: Extract container images
+      ansible.builtin.unarchive:
+        src: /opt/metacluster/container_images/images-tarballs.tgz
+        dest: /opt/metacluster/container_images
+        list_files: yes
+      register: imagetarballs
+
+    - ansible.builtin.debug:
+        var: imagetarballs
+
+    - name: Import container images
+      ansible.builtin.command:
+        cmd: k3s ctr image import {{ item }}
+        chdir: /opt/metacluster/container_images
+      loop: "{{ imagetarballs.stdout_lines }}"
+
+    - name: Delete redundant files
+      ansible.builtin.file:
+        path: /opt/metacluster/container_images
+        state: absent
+
+- name: Cleanup tempfile
+  ansible.builtin.file:
+    path: "{{ kubeconfig.path }}"
+    state: absent
+  when: kubeconfig.path is defined

ansible/roles/firstboot/files/ansible_payload/roles/network/tasks/main.yml

@@ -1,10 +1,12 @@
 - name: Set hostname
   ansible.builtin.hostname:
-    name: "{{ ovfproperties['guestinfo.hostname'] }}"
+    name: "{{ vapp['guestinfo.hostname'] }}"
+
 - name: Create netplan configuration file
   ansible.builtin.template:
     src: netplan.j2
     dest: /etc/netplan/00-installer-config.yaml
+
 - name: Apply netplan configuration
   ansible.builtin.shell:
     cmd: /usr/sbin/netplan apply

ansible/roles/firstboot/files/ansible_payload/roles/network/templates/netplan.j2

@@ -3,8 +3,8 @@ network:
   ethernets:
     ens192:
       addresses:
-      - {{ ovfproperties['guestinfo.ipaddress'] }}/{{ ovfproperties['guestinfo.prefixlength'] }}
-      gateway4: {{ ovfproperties['guestinfo.gateway'] }}
+      - {{ vapp['guestinfo.ipaddress'] }}/{{ vapp['guestinfo.prefixlength'] }}
+      gateway4: {{ vapp['guestinfo.gateway'] }}
       nameservers:
         addresses:
-        - {{ ovfproperties['guestinfo.dnsserver'] }}
+        - {{ vapp['guestinfo.dnsserver'] }}

ansible/roles/firstboot/files/ansible_payload/roles/users/tasks/main.yml

@@ -1,14 +1,14 @@
 - name: Set root password
   ansible.builtin.user:
     name: root
-    password: "{{ ovfproperties['guestinfo.rootpw'] | password_hash('sha512', 65534 | random(seed=ovfproperties['guestinfo.hostname']) | string) }}"
+    password: "{{ vapp['guestinfo.rootpw'] | password_hash('sha512', 65534 | random(seed=vapp['guestinfo.hostname']) | string) }}"
     generate_ssh_key: yes
     ssh_key_bits: 2048
     ssh_key_file: .ssh/id_rsa
 - name: Save root SSH publickey
   ansible.builtin.lineinfile:
     path: /root/.ssh/authorized_keys
-    line: "{{ ovfproperties['guestinfo.rootsshkey'] }}"
+    line: "{{ vapp['guestinfo.rootsshkey'] }}"
 - name: Disable SSH password authentication
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config

ansible/roles/firstboot/files/ansible_payload/roles/vapp/tasks/main.yml

@@ -12,8 +12,8 @@
   register: ovfenv
 - name: Assign vApp properties to dictionary
   ansible.builtin.set_fact:
-    ovfproperties: >-
-      {{ ovfproperties | default({}) |
+    vapp: >-
+      {{ vapp | default({}) |
       combine({((item.values() | list)[0].values() | list)[0]:
       ((item.values() | list)[0].values() | list)[1]})
       }}

ansible/roles/firstboot/tasks/main.yml

@@ -2,6 +2,7 @@
   ansible.builtin.file:
     path: /opt/firstboot
     state: directory
+
 - name: Create firstboot script file
   ansible.builtin.template:
     src: firstboot.j2
@@ -9,11 +10,13 @@
     owner: root
     group: root
     mode: o+x
+
 - name: Create @reboot crontab job
   ansible.builtin.cron:
     name: firstboot
     special_time: reboot
     job: "/opt/firstboot/firstboot.sh"
+
 - name: Copy payload folder
   ansible.builtin.copy:
     src: ansible_payload/
@@ -21,6 +24,3 @@
     owner: root
     group: root
     mode: '0644'
-- name: Install ansible-galaxy collection
-  ansible.builtin.shell:
-    cmd: ansible-galaxy collection install community.general

ansible/roles/metacluster/tasks/cleanup.yml

@@ -0,0 +1,4 @@
+- name: Zero-out disk
+  ansible.builtin.shell:
+    cmd: dd bs=1M count=$(df -m . | awk '/[0-9]%/{print $(NF-2)}') if=/dev/zero of=./zero; sync; sync; rm -f ./zero
+    chdir: /opt/metacluster

ansible/roles/metacluster/tasks/components.yml

@@ -0,0 +1,44 @@
+- name: Create folder structure(s)
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /opt/metacluster/helm-charts
+    - /opt/metacluster/container-images
+
+- name: Add helm repositories
+  kubernetes.core.helm_repository:
+    name: "{{ item.name }}"
+    repo_url: "{{ item.url }}"
+    state: present
+  loop: "{{ platform.helm_repositories }}"
+
+- name: Fetch helm charts
+  ansible.builtin.command:
+    cmd: helm fetch {{ item.value.helm.chart }} --untar --version {{ item.value.helm.version }}
+    chdir: /opt/metacluster/helm-charts
+  loop: "{{ lookup('ansible.builtin.dict', components) }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: Parse helm charts for container images
+  ansible.builtin.shell:
+    cmd: "{{ item.value.helm.parse_logic }}"
+    chdir: /opt/metacluster/helm-charts/{{ item.value.helm.basedir | default(item.key) }}
+  register: containerimages
+  loop: "{{ lookup('ansible.builtin.dict', components) }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: Pull and store containerimages
+  ansible.builtin.command:
+    cmd: skopeo copy docker://{{ item }} docker-archive:./{{ ( item | regex_findall('[^/:]+'))[-2] }}.tar:{{ item }}
+    chdir: /opt/metacluster/container-images
+  loop: "{{ containerimages.results | map(attribute='stdout_lines') | flatten }}"
+
+- name: Compress tarballs
+  community.general.archive:
+    dest: /opt/metacluster/container-images/image-tarballs.tgz
+    path: /opt/metacluster/container-images/*
+    format: gz
+    remove: yes

ansible/roles/metacluster/tasks/k3s.yml

@@ -0,0 +1,28 @@
+- name: Create folder structure(s)
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+  loop:
+    - /var/lib/rancher/k3s/agent/images
+    - /opt/metacluster/k3s
+
+- name: Download & install K3s binary
+  ansible.builtin.get_url:
+    url: https://github.com/k3s-io/k3s/releases/download/{{ platform.k3s.version }}/k3s
+    dest: /usr/local/bin/k3s
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Download K3s images tarball
+  ansible.builtin.get_url:
+    url: https://github.com/k3s-io/k3s/releases/download/{{ platform.k3s.version }}/k3s-airgap-images-amd64.tar.gz
+    dest: /var/lib/rancher/k3s/agent/images
+
+- name: Download K3s install script
+  ansible.builtin.get_url:
+    url: https://get.k3s.io
+    dest: /opt/metacluster/k3s/install.sh
+    owner: root
+    group: root
+    mode: 0755

ansible/roles/metacluster/tasks/main.yml

@@ -0,0 +1,6 @@
+- name: Pre-stage K3s components
+  import_tasks: k3s.yml
+- name: Pre-stage meta components
+  import_tasks: components.yml
+- name: Cleanup
+  import_tasks: cleanup.yml

ansible/roles/os/tasks/packages.yml

@@ -1,14 +1,16 @@
 - name: Install additional packages
   ansible.builtin.apt:
-    name: "{{ item }}"
+    pkg: "{{ packages }}"
     state: latest
     update_cache: yes
-  loop: "{{ packages }}"
+    install_recommends: no
+
 - name: Upgrade all packages
   ansible.builtin.apt:
-    name: "*"
+    name: '*'
     state: latest
     update_cache: yes
+
 - name: Cleanup
   ansible.builtin.apt:
     autoremove: yes

ansible/vars/metacluster.yml

@@ -0,0 +1,59 @@
+platform:
+
+  k3s:
+    version: v1.24.1+k3s1
+
+  helm_repositories:
+    - name: longhorn
+      url: https://charts.longhorn.io
+    - name: harbor
+      url: https://helm.goharbor.io
+    - name: gitea-charts
+      url: https://dl.gitea.io/charts/
+    - name: argo
+      url: https://argoproj.github.io/argo-helm
+
+components:
+
+  longhorn:
+    helm:
+      version: 1.3.0
+      chart: longhorn/longhorn
+      parse_logic: cat values.yaml | yq eval '.. | select(has("repository")) | .repository + ":" + .tag'
+
+  harbor:
+    helm:
+      version: 1.9.1  # (= Harbor v2.5.1)
+      chart: harbor/harbor
+      parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
+
+  gitea:
+    helm:
+      version: v5.0.9 # (= Gitea v1.16.8)
+      chart: gitea-charts/gitea
+      basedir: helm-chart
+      parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
+
+  argo-cd:
+    helm:
+      version: 4.9.7  # (= ArgoCD v2.4.2)
+      chart: argo/argo-cd
+      parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
+
+dependencies:
+
+  ansible_galaxy_collections:
+    - ansible.utils
+    - community.general
+    - kubernetes.core
+
+  static_binaries:
+    - filename: helm
+      url: https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz
+      archive: compressed
+      extra_opts: --strip-components=1
+    - filename: yq
+      url: http://github.com/mikefarah/yq/releases/download/v4.25.3/yq_linux_amd64
+
+  packages:
+    - skopeo

packer/k8sboostrap.pkr.hcl

@@ -3,7 +3,7 @@ packer {
   }
 }
 
-source "vsphere-iso" "ubuntuserver" {
+source "vsphere-iso" "k8sbootstrap" {
   vcenter_server          = var.vcenter_server
   username                = var.vsphere_username
   password                = var.vsphere_password
@@ -41,7 +41,7 @@ source "vsphere-iso" "ubuntuserver" {
     network_card          = "vmxnet3"
   }
   storage {
-    disk_size             = 20480
+    disk_size             = 51200
     disk_thin_provisioned = true
   }
   disk_controller_type    = ["pvscsi"]
@@ -60,18 +60,18 @@ source "vsphere-iso" "ubuntuserver" {
 
   export {
     images                = false
-    output_directory      = "/scratch/ubuntuserver"
+    output_directory      = "/scratch/k8sbootstrap"
   }
   remove_cdrom            = true
 }
 
 build {
   sources = [
-    "source.vsphere-iso.ubuntuserver"
+    "source.vsphere-iso.k8sbootstrap"
   ]
 
   provisioner "ansible" {
-    only             = ["vsphere-iso.ubuntuserver"]
+    pause_before     = "2m30s"
 
     playbook_file    = "ansible/playbook.yml"
     user             = "ubuntu"
@@ -85,16 +85,15 @@ build {
   }
 
   post-processor "shell-local" {
-    only   = ["vsphere-iso.ubuntuserver"]
     inline = [
       "pwsh -command \"& scripts/Update-OvfConfiguration.ps1 \\",
-      " -OVFFile '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.ovf' \\",
+      " -OVFFile '/scratch/k8sbootstrap/${var.vm_guestos}-${var.vm_name}.ovf' \\",
       " -Parameter @{'appliance.name'='${var.vm_guestos}';'appliance.version'='${var.vm_name}'}\"",
       "pwsh -file scripts/Update-Manifest.ps1 \\",
-      " -ManifestFileName '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.mf'",
+      " -ManifestFileName '/scratch/k8sbootstrap/${var.vm_guestos}-${var.vm_name}.mf'",
       "ovftool --acceptAllEulas --allowExtraConfig --overwrite \\",
-      " '/scratch/ubuntuserver/${var.vm_guestos}-${var.vm_name}.ovf' \\",
-      " /output/Ubuntu-Server-22.04.ova"
+      " '/scratch/k8sbootstrap/${var.vm_guestos}-${var.vm_name}.ovf' \\",
+      " /output/Kubernetes.Bootstrap.Appliance.ova"
     ]
   }
 }

packer/preseed/UbuntuServer22.04/user-data

@@ -11,6 +11,7 @@ autoinstall:
       ethernets:
         ens192:
           dhcp4: true
+          dhcp-identifier: mac
   storage:
     layout:
       name: direct