59 lines
2.6 KiB
YAML
59 lines
2.6 KiB
YAML
---
|
|
# Adjusts the Traefik k3s installs for itself, rather than installing
|
|
# anything: a HelmChartConfig merged over k3s's own Traefik HelmChart, plus —
|
|
# only when the dashboard is being published on a hostname — the
|
|
# Certificate/Middleware/IngressRoute trio that puts it behind Authentik.
|
|
# See defaults/main.yml and templates/traefik.helmchartconfig.yaml.j2.
|
|
#
|
|
# Same delivery mechanism as every other k3s_* role: template a file into
|
|
# /var/lib/rancher/k3s/server/manifests/ and let k3s's bundled helm-controller
|
|
# and deploy controller reconcile it. No helm binary, kubeconfig or extra
|
|
# collection on the controller.
|
|
|
|
- name: Fail fast if the dashboard would be exposed without authentication
|
|
when: k3s_traefik_dashboard_host | length > 0
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_traefik_dashboard_auth_address | length > 0
|
|
fail_msg: >-
|
|
k3s_traefik_dashboard_host is set but k3s_traefik_dashboard_auth_address
|
|
is empty — set both in inventory/group_vars/k3s_cluster.yml, or neither.
|
|
Publishing the dashboard without the forward-auth middleware would put a
|
|
read-only view of every router, service and middleware on this cluster
|
|
on the LAN unauthenticated, so this refuses rather than defaulting to an
|
|
address that might not be Authentik.
|
|
quiet: true
|
|
run_once: true
|
|
|
|
- name: Deploy the Traefik HelmChartConfig
|
|
ansible.builtin.template:
|
|
src: traefik.helmchartconfig.yaml.j2
|
|
dest: /var/lib/rancher/k3s/server/manifests/traefik-config.yaml
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
|
|
- name: Deploy the exposed dashboard route
|
|
when: k3s_traefik_dashboard_host | length > 0
|
|
ansible.builtin.template:
|
|
src: dashboard-ingressroute.yaml.j2
|
|
dest: /var/lib/rancher/k3s/server/manifests/traefik-dashboard.yaml
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
|
|
# Clearing k3s_traefik_dashboard_host is a teardown, not just a stop-managing:
|
|
# k3s's deploy controller garbage-collects the objects a manifest created when
|
|
# the manifest is removed, so deleting this file withdraws the public route,
|
|
# its middleware and its certificate. Same reasoning as roles/k3s_app's
|
|
# removal path — with the difference that this one needs no `state: absent`
|
|
# tombstone, because the hostname is a single value rather than a list entry
|
|
# that could be silently dropped.
|
|
- name: Withdraw the exposed dashboard route when no host is configured
|
|
when: k3s_traefik_dashboard_host | length == 0
|
|
ansible.builtin.file:
|
|
path: /var/lib/rancher/k3s/server/manifests/traefik-dashboard.yaml
|
|
state: absent
|
|
become: true
|