feat(k3s): add deployment rules for Helm and OpenTofu projects

TODO

@@ -1,8 +0,0 @@
-- /etc/lvm/lvm.conf -> issue_discards = 1
-- deploy hashicorp/vault to store encrypted files:
-    - user SSH keys
-    - user passwords
-    - secure files
-- setup fstab with sshfs, noatime
-- add smartmontools & conf
-- auto-add ssh hosts to known_hosts

ansible_galaxy-requirements.yml

@@ -2,3 +2,5 @@
 collections:
   - name: kubernetes.core
     version: 3.0.0
+  - name: community.general
+    version: 9.0.0

collections/ansible_collections/nullified/infrastructure/roles/k3s/defaults/main.yml

@@ -6,3 +6,4 @@ k3s_extra_args: ''
 k3s_operator_ips: []
 k3s_cluster_cidr: '10.42.0.0/16'
 k3s_service_cidr: '10.43.0.0/16'
+k3s_cluster_additional_helm_charts: []

collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/opentofu.yml

@@ -0,0 +1,75 @@
+- name: deploy OpenTofu resource
+  connection: local
+  block:
+    - name: find terraform binary
+      ansible.builtin.command:
+        cmd: bash -c 'command -v terraform || command -v tofu || echo /usr/local/bin/terraform'
+      register: located_tf_binary
+      when: terraform_binary_path is undefined
+      changed_when: false
+
+    - name: set terraform binary
+      ansible.builtin.set_fact:
+        terraform_binary_path: '{{ terraform_binary_path | default(located_tf_binary.stdout, true) }}'
+      when: terraform_binary_path is undefined
+
+    - name: create temp directory
+      ansible.builtin.tempfile:
+        state: directory
+      register: tmp_file
+      changed_when: false
+      when: item.storage_dir is not defined
+
+    - name: set target directory for git repository
+      ansible.builtin.set_fact:
+        git_clone_dir: '{{ item.storage_dir | default(tmp_file.path, true) }}'
+
+    - name: fetch git repository
+      ansible.builtin.git:
+        repo: '{{ item.git_repository }}'
+        dest: '{{ git_clone_dir }}'
+        version: '{{ item.git_revision }}'
+        force: true
+
+    - name: prepare variables file
+      ansible.builtin.copy:
+        content: '{{ item.tfvars_content }}'
+        dest: '{{ git_clone_dir }}/{{ item.terraform_dir }}/terraform.tfvars'
+        mode: '0500'
+        force: true
+
+    - name: prepare tfstate file
+      ansible.builtin.copy:
+        src: '{{ item.tfstate_path }}'
+        dest: '{{ git_clone_dir }}/{{ item.terraform_dir }}/terraform.tfstate'
+        force: true
+        mode: '0600'
+      when: git_clone_dir not in item.tfstate_path
+
+    - name: deploy k8s resources
+      community.general.terraform:
+        binary_path: "{{ terraform_binary_path }}"
+        project_path: '{{ git_clone_dir }}/{{ item.terraform_dir}}'
+        provider_upgrade: true
+        force_init: true
+
+    - name: backup source stored state
+      ansible.builtin.copy:
+        src: '{{ item.tfstate_path }}'
+        dest: '{{ item.tfstate_path }}.ansible.backup'
+        force: true
+        mode: '0600'
+
+    - name: update source tfstate file
+      ansible.builtin.copy:
+        src: '{{ git_clone_dir }}/{{ item.terraform_dir}}/terraform.tfstate'
+        dest: '{{ item.tfstate_path }}'
+        force: true
+        mode: '0600'
+      when: git_clone_dir not in item.tfstate_path
+
+    - name: cleanup
+      ansible.builtin.file:
+        path: '{{ tmp_file.path }}'
+        state: absent
+      when: item.storage_dir is not defined

collections/ansible_collections/nullified/infrastructure/roles/k3s/tasks/server.yml

@@ -42,3 +42,16 @@
   debug: msg="Not supported yet"
   when: k3s_cluster_type is match("ha")
   failed_when: true
+
+- name: install Helm charts
+  connection: local
+  kubernetes.core.helm: '{{ item }}'
+  loop: '{{ k3s_cluster_additional_helm_charts }}'
+  loop_control:
+    label: '{{ item.release_name }}'
+
+- name: install OpenTofu resources
+  include_tasks: opentofu.yml
+  loop: '{{ k3s_cluster_additional_tf_resources }}'
+  loop_control:
+    label: '{{ item.name }}'

inventory/host_vars/actinium/vars.yml

@@ -4,6 +4,7 @@ ansible_user: "{{ vault_ssh_user }}"
 
 security_firewall_mangle_drop_privatenets: false
 security_firewall_mangle_policy_forward: accept
+security_firewall_filter_policy_forward: accept
 
 k3s_cluster_name: internal
 k3s_cluster_role: server
@@ -12,3 +13,20 @@ k3s_cluster_ip: "{{ vault_cluster_ip }}"
 mariadb_server_root_password: "{{ vault_mariadb_server_root_password }}"
 mariadb_server_custom_sql: "{{ vault_mariadb_server_custom_sql }}"
 mariadb_server_bind_addresses: "{{ vault_mariadb_server_bind_addresses }}"
+
+k3s_cluster_additional_helm_charts:
+  - release_name: redis
+    release_namespace: default
+    chart_ref: 'oci://registry-1.docker.io/bitnamicharts/redis'
+    chart_version: '^18'
+    values:
+      replica:
+        replicaCount: 1
+k3s_cluster_additional_tf_resources:
+  - name: Invoice Ninja
+    git_repository: 'https://gitlab.0x2a.ninja/flowtech/oss/invoice-ninja.git'
+    git_revision: 0.0.3
+    terraform_dir: 'terraform'
+    tfvars_content: '{{ vault_invoice_ninja_tfvars }}'
+    tfstate_path: '{{ vault_invoice_ninja_tfstate_path }}'
+    # storage_dir:

inventory/host_vars/unobtainium/vars.yml

@@ -21,3 +21,6 @@ common_sysctl_configuration:
 security_firewall_filter_policy_output: accept
 security_firewall_filter_policy_forward: accept
 security_firewall_mangle_policy_forward: accept
+
+# provisioner role
+terraform_binary_path: '/usr/bin/tofu'