Drop support for CentOS, test Rocky and Debian in CI (#92)

* Test CentOS 7 in CI

* Drop support for CentOS, test on Rocky and Debian

* Fix reset playbook for Rocky Linux

* Fix typo

* Disable firewalld during testing

Co-authored-by: Techno Tim <timothystewart6@gmail.com>

.github/download-boxes.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# download-boxes.sh
+# Check all molecule.yml files for required Vagrant boxes and download the ones that are not
+# already present on the system.
+
+set -euo pipefail
+
+GIT_ROOT=$(git rev-parse --show-toplevel)
+PROVIDER=virtualbox
+
+# Read all boxes for all platforms from the "molecule.yml" files
+all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
+    yq -r '.platforms[].box' |         # Read the "box" property of each node under "platforms"
+    grep --invert-match --regexp=--- | # Filter out file separators
+    sort |
+    uniq)
+
+# Read the boxes that are currently present on the system (for the current provider)
+present_boxes=$(vagrant box list |
+    grep "${PROVIDER}" | # Filter by boxes available for the current provider
+    awk '{print $1;}' |  # The box name is the first word in each line
+    sort |
+    uniq)
+
+# The boxes that we need to download are the ones present in $all_boxes, but not $present_boxes.
+download_boxes=$(comm -2 -3 <(echo "${all_boxes}") <(echo "${present_boxes}"))
+
+# Actually download the necessary boxes
+if [ -n "${download_boxes}" ]; then
+    echo "${download_boxes}" | while IFS= read -r box; do
+        vagrant box add --provider "${PROVIDER}" "${box}"
+    done
+fi

.github/workflows/test.yml

@@ -43,6 +43,12 @@ jobs:
           restore-keys: |
             vagrant-boxes
 
+      - name: Download Vagrant boxes for all scenarios
+        # To save some cache space, all scenarios share the same cache key.
+        # On the other hand, this means that the cache contents should be
+        # the same across all scenarios. This step ensures that.
+        run: ./.github/download-boxes.sh
+
       - name: Set up Python ${{ env.PYTHON_VERSION }}
         uses: actions/setup-python@v2
         with:

README.md

@@ -16,9 +16,9 @@ If you want more context on how this works, see:
 
 Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
 
-- [X] Debian
+- [x] Debian (tested on version 11)
-- [X] Ubuntu
+- [x] Ubuntu (tested on version 22.04)
-- [X] CentOS
+- [x] Rocky (tested on version 9)
 
 on processor architecture:
 

molecule/default/molecule.yml

@@ -3,43 +3,52 @@ dependency:
   name: galaxy
 driver:
   name: vagrant
-platforms:
+.platform_presets:
   - &control
-    name: control1
-    box: generic/ubuntu2204
     memory: 2048
     cpus: 2
+    groups:
+      - k3s_cluster
+      - master
+  - &node
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - node
+  - &debian
+    box: generic/debian11
+  - &rocky
+    box: generic/rocky9
+  - &ubuntu
+    box: generic/ubuntu2204
     config_options:
       # We currently can not use public-key based authentication on Ubuntu 22.04,
       # see: https://github.com/chef/bento/issues/1405
       ssh.username: "vagrant"
       ssh.password: "vagrant"
-    groups:
+platforms:
-      - k3s_cluster
+  - <<: [*control, *ubuntu]
-      - master
+    name: control1
     interfaces:
       - network_name: private_network
         ip: 192.168.30.38
-  - <<: *control
+  - <<: [*control, *debian]
     name: control2
     interfaces:
       - network_name: private_network
         ip: 192.168.30.39
-  - <<: *control
+  - <<: [*control, *rocky]
     name: control3
     interfaces:
       - network_name: private_network
         ip: 192.168.30.40
-  - &node
+  - <<: [*node, *ubuntu]
-    <<: *control
     name: node1
-    groups:
-      - k3s_cluster
-      - node
     interfaces:
       - network_name: private_network
         ip: 192.168.30.41
-  - <<: *node
+  - <<: [*node, *rocky]
     name: node2
     interfaces:
       - network_name: private_network

molecule/default/prepare.yml

@@ -0,0 +1,22 @@
+---
+- name: Apply overrides
+  ansible.builtin.import_playbook: >-
+    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
+
+- name: Network setup
+  hosts: all
+  tasks:
+    - name: Disable firewalld
+      when: ansible_distribution == "Rocky"
+      # Rocky Linux comes with firewalld enabled. It blocks some of the network
+      # connections needed for our k3s cluster. For our test setup, we just disable
+      # it since the VM host's firewall is still active for connections to and from
+      # the Internet.
+      # When building your own cluster, please DO NOT blindly copy this. Instead,
+      # please create a custom firewall configuration that fits your network design
+      # and security needs.
+      ansible.builtin.systemd:
+        name: firewalld
+        enabled: no
+        state: stopped
+      become: true

molecule/ipv6/molecule.yml

@@ -3,28 +3,34 @@ dependency:
   name: galaxy
 driver:
   name: vagrant
-platforms:
+.platform_presets:
   - &control
-    name: control1
-    box: generic/ubuntu2204
     memory: 2048
     cpus: 2
+    groups:
+      - k3s_cluster
+      - master
+  - &node
+    memory: 2048
+    cpus: 2
+    groups:
+      - k3s_cluster
+      - node
+  - &ubuntu
+    box: generic/ubuntu2204
     config_options:
       # We currently can not use public-key based authentication on Ubuntu 22.04,
       # see: https://github.com/chef/bento/issues/1405
       ssh.username: "vagrant"
       ssh.password: "vagrant"
-    groups:
+platforms:
-      - k3s_cluster
+  - <<: [*control, *ubuntu]
-      - master
+    name: control1
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:11
-  - <<: *control
+  - <<: [*node, *ubuntu]
     name: node1
-    groups:
-      - k3s_cluster
-      - node
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:21

reset.yml

@@ -4,4 +4,10 @@
   gather_facts: yes
   become: yes
   roles:
+    - role: raspberrypi
+      vars: {state: absent}
     - role: reset
+  post_tasks:
+    - name: Reboot and wait for node to come back up
+      reboot:
+        reboot_timeout: 3600

roles/raspberrypi/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# Indicates whether the k3s prerequisites for Raspberry Pi should be set up
+# Possible values:
+#   - present
+#   - absent
+state: present

roles/raspberrypi/tasks/main.yml

@@ -47,13 +47,20 @@
     - raspberry_pi|default(false)
     - ansible_facts.lsb.description|default("") is match("Debian.*bullseye")
 
-- name: execute OS related tasks on the Raspberry Pi
+- name: execute OS related {{ action }} tasks on the Raspberry Pi
   include_tasks: "{{ item }}"
   with_first_found:
-    - "prereq/{{ detected_distribution }}-{{ detected_distribution_major_version }}.yml"
+    - "{{ action }}/{{ detected_distribution }}-{{ detected_distribution_major_version }}.yml"
-    - "prereq/{{ detected_distribution }}.yml"
+    - "{{ action }}/{{ detected_distribution }}.yml"
-    - "prereq/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
+    - "{{ action }}/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
-    - "prereq/{{ ansible_distribution }}.yml"
+    - "{{ action }}/{{ ansible_distribution }}.yml"
-    - "prereq/default.yml"
+    - "{{ action }}/default.yml"
+  vars:
+    action: >-
+      {% if state == "present" -%}
+      setup
+      {%- else -%}
+      teardown
+      {%- endif %}
   when:
     - raspberry_pi|default(false)

roles/raspberrypi/tasks/setup/Rocky.yml

@@ -1,5 +1,5 @@
 ---
-- name: Enable cgroup via boot commandline if not already enabled for Centos
+- name: Enable cgroup via boot commandline if not already enabled for Rocky
   lineinfile:
     path: /boot/cmdline.txt
     backrefs: yes

roles/raspberrypi/tasks/setup/Ubuntu.yml

@@ -6,8 +6,16 @@
     regexp: '^((?!.*\bcgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory\b).*)$'
     line: '\1 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory'
   notify: reboot
-  when: not ansible_check_mode
 
 - name: Install linux-modules-extra-raspi
-  apt: name=linux-modules-extra-raspi state=present
+  apt:
-  when: (raspberry_pi) and (not ansible_check_mode)
+    name: linux-modules-extra-raspi
+    state: present
+
+- name: Teardown
+  when: state == "absent"
+  block:
+    - name: Remove linux-modules-extra-raspi
+      apt:
+        name: linux-modules-extra-raspi
+        state: absent

roles/raspberrypi/tasks/teardown/Raspbian.yml

@@ -0,0 +1 @@
+---

roles/raspberrypi/tasks/teardown/Rocky.yml

@@ -0,0 +1 @@
+---

roles/raspberrypi/tasks/teardown/Ubuntu.yml

@@ -0,0 +1,5 @@
+---
+- name: Remove linux-modules-extra-raspi
+  apt:
+    name: linux-modules-extra-raspi
+    state: absent

roles/raspberrypi/tasks/teardown/default.yml

@@ -0,0 +1 @@
+---

roles/reset/tasks/main.yml

@@ -50,14 +50,7 @@
   systemd:
     daemon_reload: yes
 
-- name: Remove linux-modules-extra-raspi
+- name: Remove tmp directory used for manifests
-  apt: name=linux-modules-extra-raspi state=absent
-
-- name: Remove tmp director used for manifests
   file:
     path: /tmp/k3s
     state: absent
-
-- name: Reboot and wait for node to come back up
-  reboot:
-    reboot_timeout: 3600