From bbf954ba0941b030ad71f59f2f7cf3937aea05dc Mon Sep 17 00:00:00 2001 From: mrwho Date: Wed, 15 Jul 2026 16:09:15 +0300 Subject: [PATCH] fix(k8s): update inventory configuration for production cluster - set ansible_user to 'mrwho' and disable SSH password authentication - upgrade k8s_version to 1.36 in all.yml (removed from control_plane.yml) - reduce traefik ingress routes to only k8s-dashboard and longhorn-ui with HTTPS - update host IP addresses to 172.20.21.x subnet - configure longhorn disk for k8s-worker-01 --- inventory/prod/group_vars/all.yml | 8 +- inventory/prod/group_vars/control_plane.yml | 1 - inventory/prod/group_vars/traefik.yml | 115 +------------------- inventory/prod/hosts.yml | 21 ++-- 4 files changed, 21 insertions(+), 124 deletions(-) diff --git a/inventory/prod/group_vars/all.yml b/inventory/prod/group_vars/all.yml index e392191..834f67b 100644 --- a/inventory/prod/group_vars/all.yml +++ b/inventory/prod/group_vars/all.yml @@ -1,5 +1,7 @@ --- -ansible_user: "{{ lookup('env', 'ANSIBLE_SSH_USER') | default('ansible') }}" +#ansible_user: "{{ lookup('env', 'ANSIBLE_SSH_USER') | default('ansible') }}" +ansible_user: mrwho ansible_become: true -ansible_become_method: sudo -ansible_become_pass: "{{ lookup('env', 'ANSIBLE_BECOME_PASS') | default(omit) }}" +#ansible_become_method: sudo +#ansible_become_pass: "{{ lookup('env', 'ANSIBLE_BECOME_PASS') | default(omit) }}" +k8s_version: "1.36" diff --git a/inventory/prod/group_vars/control_plane.yml b/inventory/prod/group_vars/control_plane.yml index 80c70ae..ad5af97 100644 --- a/inventory/prod/group_vars/control_plane.yml +++ b/inventory/prod/group_vars/control_plane.yml @@ -1,4 +1,3 @@ --- -k8s_version: "1.33" cni_plugin: "flannel" kubeconfig_fetch_to_managers: true diff --git a/inventory/prod/group_vars/traefik.yml b/inventory/prod/group_vars/traefik.yml index 9901b25..f5897b5 100644 --- a/inventory/prod/group_vars/traefik.yml +++ b/inventory/prod/group_vars/traefik.yml @@ -1,31 +1,21 @@ --- +traefik_enable_ingress: true +traefik_ingress_class_name: "traefik" +traefik_namespace: kube-system traefik_port_map: - name: k8s-dashboard - description: "Kubernetes Dashboard" port: 10001 backend: namespace: kubernetes-dashboard service: kubernetes-dashboard port: 443 - scheme: http - basicauth: - enabled: false - - - name: grafana - description: "Grafana (Logs & Metrics)" - port: 10003 - backend: - namespace: monitoring - service: grafana - port: 80 - scheme: http + scheme: https basicauth: enabled: false - name: longhorn-ui - description: "Longhorn Storage UI" port: 10002 backend: namespace: longhorn-system @@ -36,103 +26,6 @@ traefik_port_map: enabled: true secret_name: traefik-auth-longhorn - - name: minio-api - description: "MinIO S3 API" - port: 10005 - backend: - namespace: minio - service: minio - port: 9000 - scheme: http - basicauth: - enabled: false - - - name: minio-console - description: "MinIO Console (Web UI)" - port: 10006 - backend: - namespace: minio - service: minio-console - port: 9001 - scheme: http - basicauth: - enabled: false - - - name: billing-backend - description: "Mobile Billing Backend API" - port: 10100 - backend: - namespace: gigacom-billing-mobile - service: billing-backend - port: 8080 - scheme: http - basicauth: - enabled: false - - - name: bgbilling - description: "BGBillingServer HTTP (web UI, API)" - port: 10101 - backend: - namespace: bgbilling-dev - service: bgbilling - port: 8080 - scheme: http - basicauth: - enabled: false - - - name: bgbilling-https - description: "BGBillingServer HTTPS (Tomcat TLS, .keystore)" - port: 10102 - backend: - namespace: bgbilling-dev - service: bgbilling - port: 8443 - scheme: https - basicauth: - enabled: false - - - name: bgbilling-db - description: "MariaDB for BGBilling (TCP)" - protocol: tcp - port: 10103 - backend: - namespace: bgbilling-dev - service: db - port: 3306 - - - name: activemq-web - description: "ActiveMQ Web Console" - port: 10104 - backend: - namespace: bgbilling-dev - service: activemq - port: 8161 - scheme: http - basicauth: - enabled: false - - - name: ollama-proxy - description: "Ollama Proxy API (k8s_ai)" - port: 10200 - backend: - namespace: ai - service: ollama-proxy - port: 8080 - scheme: http - basicauth: - enabled: false - - - name: open-webui - description: "Open WebUI (k8s_ai)" - port: 10201 - backend: - namespace: ai - service: open-webui - port: 8080 - scheme: http - basicauth: - enabled: false - # Template for future services: # - name: my-service # description: "Human-readable description" diff --git a/inventory/prod/hosts.yml b/inventory/prod/hosts.yml index 0793a39..f9577fe 100644 --- a/inventory/prod/hosts.yml +++ b/inventory/prod/hosts.yml @@ -5,7 +5,7 @@ all: manager_nodes: hosts: k8s-manager-01: - ansible_host: 10.203.0.92 + ansible_host: 172.20.21.200 # Kubernetes cluster nodes k8s_cluster: @@ -13,14 +13,17 @@ all: control_plane: hosts: k8s-master-01: - ansible_host: 10.203.0.97 + ansible_host: 172.20.21.201 workers: hosts: k8s-worker-01: - ansible_host: 10.203.0.96 - children: - # Workers with an NVIDIA GPU attached (device plugin + node label) - gpu_workers: - hosts: - k8s-worker-02: - ansible_host: 10.203.0.212 + ansible_host: 172.20.21.202 + longhorn_disks: + - device: /dev/sdb + mountpoint: /mnt/longhorn-disk1 +# children: +# # Workers with an NVIDIA GPU attached (device plugin + node label) +# gpu_workers: +# hosts: +# k8s-worker-02: +# ansible_host: 10.203.0.212