92 lines
3.7 KiB
YAML
92 lines
3.7 KiB
YAML
---
|
|
- name: Dashboard | Check kubeconfig exists
|
|
ansible.builtin.stat:
|
|
path: "{{ kubeconfig_dir }}/config"
|
|
register: _kubeconfig_dash
|
|
|
|
- name: Dashboard | Skip notice
|
|
ansible.builtin.debug:
|
|
msg: "Dashboard install skipped — kubeconfig not found at {{ kubeconfig_dir }}/config."
|
|
when: not _kubeconfig_dash.stat.exists
|
|
|
|
- name: Dashboard | Deploy and configure
|
|
when:
|
|
- _kubeconfig_dash.stat.exists
|
|
- dashboard_enabled | bool
|
|
environment:
|
|
KUBECONFIG: "{{ kubeconfig_dir }}/config"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
block:
|
|
- name: Dashboard | Apply manifest
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f {{ dashboard_manifest_url }}
|
|
register: _dash_apply
|
|
changed_when: "'configured' in _dash_apply.stdout or 'created' in _dash_apply.stdout"
|
|
|
|
- name: Dashboard | Patch deployment for insecure HTTP access
|
|
ansible.builtin.command: >
|
|
kubectl patch deployment kubernetes-dashboard
|
|
-n {{ dashboard_namespace }}
|
|
--type strategic
|
|
-p '{"spec":{"template":{"spec":{"containers":[{"name":"kubernetes-dashboard","args":["--namespace={{ dashboard_namespace }}","--enable-insecure-login","--insecure-port=9090","--port=0"],"ports":[{"containerPort":9090,"protocol":"TCP"}],"livenessProbe":{"httpGet":{"path":"/","port":9090,"scheme":"HTTP"}}}]}}}}'
|
|
register: _dash_deploy_patch
|
|
changed_when: "'patched' in _dash_deploy_patch.stdout"
|
|
failed_when: _dash_deploy_patch.rc != 0 and 'unchanged' not in _dash_deploy_patch.stdout
|
|
when: dashboard_insecure | bool
|
|
check_mode: false
|
|
|
|
- name: Dashboard | Patch service to ClusterIP
|
|
ansible.builtin.command: >
|
|
kubectl patch svc kubernetes-dashboard
|
|
-n {{ dashboard_namespace }}
|
|
-p '{"spec":{"type":"ClusterIP","ports":[{"port":443,"targetPort":{{ 9090 if dashboard_insecure | bool else 8443 }},"protocol":"TCP"}]}}'
|
|
register: _dash_patch
|
|
changed_when: "'patched' in _dash_patch.stdout"
|
|
failed_when: _dash_patch.rc != 0 and 'not patched' not in _dash_patch.stdout
|
|
check_mode: false
|
|
|
|
- name: Dashboard | Apply admin ServiceAccount
|
|
ansible.builtin.template:
|
|
src: dashboard_admin.yml.j2
|
|
dest: /tmp/dashboard_admin.yml
|
|
mode: "0600"
|
|
|
|
- name: Dashboard | Create admin user
|
|
ansible.builtin.command:
|
|
cmd: kubectl apply -f /tmp/dashboard_admin.yml
|
|
register: _dash_admin
|
|
changed_when: "'created' in _dash_admin.stdout"
|
|
|
|
- name: Dashboard | Check if token file exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ ansible_user }}/.kube/dashboard-token"
|
|
register: _token_file
|
|
|
|
- name: Dashboard | Generate long-lived token
|
|
ansible.builtin.command:
|
|
cmd: kubectl -n {{ dashboard_namespace }} create token admin-user --duration=8760h
|
|
register: _dashboard_token
|
|
changed_when: true
|
|
when: not _token_file.stat.exists
|
|
|
|
- name: Dashboard | Save token to file
|
|
ansible.builtin.copy:
|
|
content: "{{ _dashboard_token.stdout }}\n"
|
|
dest: "/home/{{ ansible_user }}/.kube/dashboard-token"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0600"
|
|
when: not _token_file.stat.exists
|
|
|
|
- name: Dashboard | Show access info
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
============================================================
|
|
Kubernetes Dashboard: accessible via Traefik proxy.
|
|
{% if dashboard_insecure | bool %}
|
|
Mode: HTTP (insecure) — TLS terminated by Traefik
|
|
{% endif %}
|
|
Token saved to: ~/.kube/dashboard-token
|
|
View token: cat ~/.kube/dashboard-token
|
|
============================================================
|