Cleanup and reorganize vars by environment

group_vars/all/traefik-account

@@ -1,7 +0,0 @@
-traefik_serviceaccount: |
-  ---
-  apiVersion: v1
-  kind: ServiceAccount
-  metadata:
-    name: traefik-ingress-controller
-    namespace: kube-system

group_vars/all/traefik-daemonset

@@ -1,101 +0,0 @@
-traefik_daemonset: |
-  ---
-  kind: DaemonSet
-  apiVersion: apps/v1
-  metadata:
-    name: traefik-ingress-controller
-    namespace: kube-system
-    labels:
-      k8s-app: traefik-ingress-lb
-  spec:
-    selector:
-      matchLabels:
-        k8s-app: traefik-ingress-lb
-    updateStrategy:
-      type: RollingUpdate
-    template:
-      metadata:
-        labels:
-          k8s-app: traefik-ingress-lb
-          name: traefik-ingress-lb
-      spec:
-        serviceAccountName: traefik-ingress-controller
-        terminationGracePeriodSeconds: 60
-        hostNetwork: true
-        dnsPolicy: ClusterFirstWithHostNet
-        containers:
-        - image: traefik:v1.7-alpine
-          name: traefik-ingress-lb
-          imagePullPolicy: IfNotPresent
-          livenessProbe:
-            failureThreshold: 2
-            httpGet:
-              path: /ping
-              port: 8080
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 5
-          readinessProbe:
-            failureThreshold: 2
-            httpGet:
-              path: /ping
-              port: 8080
-              scheme: HTTP
-            periodSeconds: 5
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "250m"
-            limits:
-              memory: "64Mi"
-              cpu: "250m"
-          ports:
-          - name: http
-            containerPort: 80
-            hostPort: 80
-          - name: https
-            containerPort: 443
-            hostPort: 443
-          - name: admin
-            containerPort: 8080
-          securityContext:
-            privileged: true
-          volumeMounts:
-          - name: tls
-            mountPath: {{k8s_conf_dir}}
-            readOnly: true
-          args:
-          - --checknewversion=false
-          - --loglevel=INFO
-          - --defaultentrypoints=http,https
-          - --entrypoints=Name:http Address::80 Redirect.EntryPoint:https
-          - --entrypoints=Name:https Address::443 TLS
-          - --etcd=true
-          - --etcd.prefix=/traefik
-          - --etcd.watch=true
-          - --etcd.endpoint={{groups.k8s_etcd|first}}:2379
-          - --etcd.tls=true
-          - --etcd.tls.ca={{k8s_conf_dir}}/ca-etcd.pem
-          - --etcd.tls.cert={{k8s_conf_dir}}/cert-etcd.pem
-          - --etcd.tls.key={{k8s_conf_dir}}/cert-etcd-key.pem
-          - --etcd.useapiv3=true
-          - --kubernetes=true
-          - --kubernetes.watch=true
-          - --kubernetes.namespaces=default
-          - --web=true
-          - --web.readonly
-          - --web.address=:8080
-          - --acme=true
-          - --acme.acmelogging=true
-          - --acme.caserver=https://acme-staging.api.letsencrypt.org/directory
-          - --acme.entrypoint=https
-          - --acme.httpchallenge=true
-          - --acme.httpChallenge.entryPoint=http
-          - --acme.email=letsencrypt.account@banditlair.com
-          - --acme.onhostrule
-          - --acme.storage=/traefik/acme/account
-        volumes:
-          - name: tls
-            secret:
-              secretName: traefik-etcd
-

group_vars/all/traefik-role

@@ -1,40 +0,0 @@
-traefik_clusterrole: |
-  ---
-  kind: ClusterRole
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: traefik-ingress-controller
-  rules:
-    - apiGroups:
-        - ""
-      resources:
-        - services
-        - endpoints
-        - secrets
-      verbs:
-        - get
-        - list
-        - watch
-    - apiGroups:
-        - extensions
-      resources:
-        - ingresses
-      verbs:
-        - get
-        - list
-        - watch
-
-traefik_clusterrolebinding: |
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: traefik-ingress-controller
-  roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: ClusterRole
-    name: traefik-ingress-controller
-  subjects:
-  - kind: ServiceAccount
-    name: traefik-ingress-controller
-    namespace: kube-system

group_vars/all/vars.yml

@@ -1,6 +1,8 @@
 ---
 ansible_python_interpreter: /usr/bin/python3
 
+kubeadm_enabled: true
+
 harden_linux_root_password: "{{k8s_scaleway_root_password}}"
 harden_linux_deploy_user: deploy
 harden_linux_deploy_user_password: "{{k8s_scaleway_deploy_user_password}}"
@@ -23,4 +25,3 @@ harden_linux_sshguard_whitelist:
   - "212.83.165.111"
   - "10.3.0.0/24"
   - "10.200.0.0/16"
-

group_vars/k8s

@@ -1,19 +0,0 @@
----
-ansible_user: root
-ansible_port: 22
-
-dashboard_subdomain: dashboard
-scaleway_ipaddr: 51.158.77.6
-scaleway_reverse_ipaddr: k8s.banditlair.com
-
-harden_linux_sshd_settings_user:
-  "^Port ": "Port 22"
-harden_linux_ufw_rules:
-  - rule: "allow"
-    to_port: "22"
-    protocol: "tcp"
-  - rule: "allow"
-    to_port: "7000"
-    protocol: "udp"
-docker_version: 17.03.*
-

group_vars/k8s-cluster.yml

@@ -0,0 +1,11 @@
+---
+ip: "{{vpn_ip}}"
+kube_network_plugin: flannel
+bin_dir: /usr/local/bin
+
+kube_api_anonymous_auth: true
+ingress_nginx_enabled: true
+ingress_nginx_host_network: true
+ingress_nginx_nodeselector:
+  node-role.kubernetes.io/node: ""
+cert_manager_enabled: true

group_vars/k8s_masters

@@ -1,2 +0,0 @@
----
-vpn_ip: 192.168.66.{{ 10 +( inventory_hostname|regex_replace('\D+','')|int) }}

group_vars/kube-master.yml

@@ -1,3 +1,2 @@
 ---
 vpn_ip: 192.168.66.{{ 0 +(inventory_hostname|regex_replace('\D+','')|int) }}
-keepalived_ip: "192.168.66.254"