109 lines
3.3 KiB
YAML
109 lines
3.3 KiB
YAML
## Updates k3s in the entire cluster
|
|
- name: Update k3s Control Plane
|
|
hosts: grp_k3s_server
|
|
serial: 1
|
|
gather_facts: false
|
|
become: true
|
|
tasks:
|
|
- name: Update k3s on control plane node
|
|
ansible.builtin.shell: >
|
|
sh <(curl -sfL https://get.k3s.io)
|
|
args:
|
|
executable: /bin/bash
|
|
register: k3s_update
|
|
|
|
- name: Print update output
|
|
ansible.builtin.debug:
|
|
var: k3s_update
|
|
|
|
- name: Update k3s Agents
|
|
hosts: grp_k3s_agent
|
|
serial: 1
|
|
gather_facts: false
|
|
become: true
|
|
tasks:
|
|
- name: Cordon agent node
|
|
ansible.builtin.command: kubectl cordon {{ inventory_hostname }}
|
|
delegate_to: "{{ groups['grp_k3s_server'][0] }}"
|
|
environment:
|
|
KUBECONFIG: /etc/rancher/k3s/k3s.yaml
|
|
ignore_errors: true
|
|
|
|
- name: Drain agent node
|
|
ansible.builtin.command: >
|
|
kubectl drain {{ inventory_hostname }}
|
|
--ignore-daemonsets
|
|
--delete-emptydir-data
|
|
--force
|
|
--timeout=60s
|
|
delegate_to: "{{ groups['grp_k3s_server'][0] }}"
|
|
environment:
|
|
KUBECONFIG: /etc/rancher/k3s/k3s.yaml
|
|
ignore_errors: true
|
|
|
|
- name: Kill k3s-agent process
|
|
ansible.builtin.shell: k3s-killall.sh
|
|
ignore_errors: true
|
|
|
|
- name: Update k3s on agent node
|
|
ansible.builtin.shell: >
|
|
sh <(curl -sfL https://get.k3s.io)
|
|
args:
|
|
executable: /bin/bash
|
|
register: k3s_update
|
|
|
|
- name: Restart k3s-agent service
|
|
ansible.builtin.systemd:
|
|
name: k3s-agent
|
|
state: restarted
|
|
|
|
- name: Fetch authoritative CA bundle from control-plane
|
|
ansible.builtin.slurp:
|
|
src: /var/lib/rancher/k3s/server/tls/{{ item }}
|
|
delegate_to: "{{ groups['grp_k3s_server'][0] }}"
|
|
register: ca_bundle
|
|
loop:
|
|
- client-ca.crt
|
|
- server-ca.crt
|
|
|
|
- name: Install server CAs into agent trust store
|
|
ansible.builtin.copy:
|
|
dest: "/var/lib/rancher/k3s/agent/{{ item.item }}"
|
|
content: "{{ item.content | b64decode }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
loop: "{{ ca_bundle.results }}"
|
|
loop_control:
|
|
label: "{{ item.item }}"
|
|
|
|
- name: Stop agent and clear stale client certs signed by old CA
|
|
ansible.builtin.shell: |
|
|
systemctl stop k3s-agent
|
|
rm -f /var/lib/rancher/k3s/agent/client-kubelet.crt \
|
|
/var/lib/rancher/k3s/agent/client-k3s-controller.crt \
|
|
/var/lib/rancher/k3s/agent/client-kube-proxy.crt \
|
|
/var/lib/rancher/k3s/agent/serving-kubelet.crt \
|
|
/var/lib/rancher/k3s/agent/kubelet.kubeconfig \
|
|
/var/lib/rancher/k3s/agent/k3scontroller.kubeconfig \
|
|
/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig \
|
|
/var/lib/rancher/k3s/agent/client-kubeconfig.yaml
|
|
args:
|
|
executable: /bin/bash
|
|
|
|
- name: Restart k3s-agent so it re-issues certs against the server CA
|
|
ansible.builtin.systemd:
|
|
name: k3s-agent
|
|
state: restarted
|
|
|
|
- name: Print update output
|
|
ansible.builtin.debug:
|
|
var: k3s_update
|
|
|
|
- name: Uncordon agent node
|
|
ansible.builtin.command: kubectl uncordon {{ inventory_hostname }}
|
|
delegate_to: "{{ groups['grp_k3s_server'][0] }}"
|
|
environment:
|
|
KUBECONFIG: /etc/rancher/k3s/k3s.yaml
|
|
ignore_errors: true
|