Erich Blume
3679124ebd
## Summary - Add `tag:k8s-api` to Pulumi ACLs and indri device tags - Configure Tailscale serve with TCP passthrough for k8s API at `k8s.tail8d86e.ts.net` - Update minikube role to include `k8s.tail8d86e.ts.net` in certificate SANs - Add `apiserver_port` config option (internal port 6443, dynamic host port with podman driver) - Document Step 0.14 in k8s-migration plan (added post-Phase 0 completion) The Kubernetes API is now accessible at `https://k8s.tail8d86e.ts.net` using TCP passthrough to preserve mTLS authentication. ## Deployment and Testing - [x] Pulumi ACLs applied - [x] Tailscale service created and approved in admin console - [x] Minikube cluster recreated with new cert SANs - [x] tailscale serve configured with TCP passthrough - [x] 1Password credentials updated with new certs - [x] Kubeconfig updated on gilbert - [x] `mise run indri-services-check` passes - [x] `kubectl --context=minikube-indri get nodes` works via Tailscale 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/27
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
---
|
|
# Minikube installation and cluster setup for indri
|
|
# Requires podman machine to be running (see podman role)
|
|
#
|
|
# NOTE: Similar to podman, minikube start may have issues when run via SSH.
|
|
# If cluster fails to start, manually run on indri:
|
|
# minikube start --driver=podman --container-runtime=cri-o \
|
|
# --cpus=4 --memory=7800 --disk-size=200g \
|
|
# --apiserver-names=k8s.tail8d86e.ts.net --apiserver-names=indri \
|
|
# --apiserver-port=6443 --listen-address=0.0.0.0
|
|
|
|
- name: Install minikube via homebrew
|
|
community.general.homebrew:
|
|
name: minikube
|
|
state: present
|
|
|
|
- name: Install kubectl via homebrew
|
|
community.general.homebrew:
|
|
name: kubectl
|
|
state: present
|
|
|
|
- name: Check if minikube cluster exists
|
|
ansible.builtin.command:
|
|
cmd: minikube status --format={% raw %}'{{.Host}}'{% endraw %}
|
|
register: minikube_status
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Start minikube cluster
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
minikube start
|
|
--driver={{ minikube_driver }}
|
|
--container-runtime={{ minikube_container_runtime }}
|
|
--cpus={{ minikube_cpus }}
|
|
--memory={{ minikube_memory }}
|
|
--disk-size={{ minikube_disk_size }}
|
|
{% for name in minikube_apiserver_names %}
|
|
--apiserver-names={{ name }}
|
|
{% endfor %}
|
|
--apiserver-port={{ minikube_apiserver_port }}
|
|
--listen-address={{ minikube_listen_address }}
|
|
register: minikube_start
|
|
changed_when: minikube_start.rc == 0
|
|
failed_when: false # Don't fail - may need manual intervention like podman
|
|
when: minikube_status.rc != 0 or 'Running' not in minikube_status.stdout
|
|
|
|
- name: Check minikube status after start attempt
|
|
ansible.builtin.command:
|
|
cmd: minikube status --format={% raw %}'{{.Host}}'{% endraw %}
|
|
register: minikube_final_status
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Warn if minikube failed to start
|
|
ansible.builtin.debug:
|
|
msg: "WARNING: minikube may not have started properly. Run 'minikube start' manually on indri if needed. Status: {{ minikube_final_status.stdout | default('unknown') }}"
|
|
when: minikube_final_status.rc != 0 or 'Running' not in minikube_final_status.stdout
|