K3S/playbooks/add-node.yml

---
# ─────────────────────────────────────────────────────────────────────────────
# Добавить новую ноду в кластер
#
# Использование:
#   make add-node NODE=master04           — новый мастер (etcd участник)
#   make add-node NODE=worker04           — новый воркер (только agent)
#
# Перед запуском:
#   1. Добавь ноду в inventory/hosts.ini в нужную группу
#   2. Убедись что SSH доступ настроен
#   3. Запусти make ping NODE=<nodename> для проверки
#
# Новые мастера: подключаются через VIP (kube-vip должен быть запущен)
# Новые воркеры: подключаются через VIP как agents (без etcd)
# ─────────────────────────────────────────────────────────────────────────────

# ── Читаем token и факты первого мастера ─────────────────────────────────────
- name: Gather cluster info from first master
  hosts: "{{ groups['k3s_master'][0] }}"
  gather_facts: true
  become: true
  tags: [always]
  tasks:
    - name: Read node-token from first master
      ansible.builtin.slurp:
        src: "{{ k3s_data_dir }}/server/node-token"
      register: _node_token_raw

    - name: Set shared token fact
      ansible.builtin.set_fact:
        k3s_node_token: "{{ _node_token_raw.content | b64decode | trim }}"

# ── Устанавливаем K3S на новую ноду ──────────────────────────────────────────
- name: Add new master node
  hosts: "{{ node_to_add | default('') }}"
  gather_facts: true
  become: true
  tags: [k3s]
  serial: 1

  vars:
    # Новые мастера используют VIP (kube-vip уже работает)
    k3s_join_address: "{{ kube_vip_address }}"
    k3s_fetch_kubeconfig: true

  pre_tasks:
    - name: Verify node is in k3s_master or k3s_workers group
      ansible.builtin.assert:
        that:
          - inventory_hostname in groups['k3s_master'] or
            (groups['k3s_workers'] is defined and inventory_hostname in groups['k3s_workers'])
        fail_msg: >
          Нода '{{ inventory_hostname }}' не найдена в группах k3s_master или k3s_workers.
          Добавь её в inventory/hosts.ini и повтори запуск.

    - name: Check if K3S already installed
      ansible.builtin.stat:
        path: /usr/local/bin/k3s
      register: k3s_installed

    - name: Abort if K3S already running
      ansible.builtin.assert:
        that: not k3s_installed.stat.exists
        fail_msg: >
          K3S уже установлен на {{ inventory_hostname }}.
          Используй make upgrade для обновления или make remove-node для удаления.

  roles:
    - role: k3s

  post_tasks:
    - name: Verify new node in cluster
      ansible.builtin.command: >
        k3s kubectl get node {{ inventory_hostname }} -o wide
      delegate_to: "{{ groups['k3s_master'][0] }}"
      become: true
      register: new_node_status
      changed_when: false
      retries: 10
      delay: 10
      until: "'Ready' in new_node_status.stdout"

    - name: Show node status
      ansible.builtin.debug:
        msg: "{{ new_node_status.stdout_lines }}"

    - name: Install NFS client on new node
      ansible.builtin.apt:
        name: nfs-common
        state: present
        update_cache: true

    - name: Summary
      ansible.builtin.debug:
        msg: >
          Нода {{ inventory_hostname }} успешно добавлена в k3s кластер.
          Тип: {{ 'master' if inventory_hostname in groups['k3s_master'] else 'worker' }}.

# ── Генерируем PKI и регистрируем в etcd (если нода в [etcd_nodes]) ──────────
- name: Generate PKI certificates for new etcd member
  hosts: localhost
  gather_facts: false
  become: false
  when:
    - k3s_etcd_type | default('embedded') == 'external'
    - groups['etcd_nodes'] is defined
    - node_to_add in groups['etcd_nodes']
  tags: [etcd]
  tasks:
    - name: Generate server/peer certs for new etcd node
      ansible.builtin.shell: |
        set -e
        NODE="{{ node_to_add }}"
        NODE_IP="{{ hostvars[node_to_add]['ansible_host'] }}"
        PKI="{{ etcd_pki_local_dir }}"
        SAN="subjectAltName=IP:${NODE_IP},IP:127.0.0.1,DNS:${NODE},DNS:localhost"

        [ -f "${PKI}/ca.key" ] || { echo "CA key not found: ${PKI}/ca.key"; exit 1; }
        rm -f "${PKI}/server-${NODE}."{crt,key,csr} "${PKI}/peer-${NODE}."{crt,key,csr}

        openssl genrsa -out "${PKI}/server-${NODE}.key" 2048
        openssl req -new -key "${PKI}/server-${NODE}.key" -out "${PKI}/server-${NODE}.csr" \
          -subj "/CN=${NODE}/O=etcd"
        openssl x509 -req -days 3650 \
          -in "${PKI}/server-${NODE}.csr" -CA "${PKI}/ca.crt" -CAkey "${PKI}/ca.key" \
          -CAcreateserial -out "${PKI}/server-${NODE}.crt" \
          -extfile <(printf "${SAN}")

        openssl genrsa -out "${PKI}/peer-${NODE}.key" 2048
        openssl req -new -key "${PKI}/peer-${NODE}.key" -out "${PKI}/peer-${NODE}.csr" \
          -subj "/CN=${NODE}/O=etcd-peer"
        openssl x509 -req -days 3650 \
          -in "${PKI}/peer-${NODE}.csr" -CA "${PKI}/ca.crt" -CAkey "${PKI}/ca.key" \
          -CAcreateserial -out "${PKI}/peer-${NODE}.crt" \
          -extfile <(printf "${SAN}")
      args:
        executable: /bin/bash
      changed_when: true

- name: Install etcd and distribute certs to new etcd member
  hosts: "{{ node_to_add }}"
  gather_facts: true
  become: true
  when:
    - k3s_etcd_type | default('embedded') == 'external'
    - groups['etcd_nodes'] is defined
    - node_to_add in groups['etcd_nodes']
  tags: [etcd]
  tasks:
    - name: Install etcd binary
      ansible.builtin.include_role:
        name: etcd
        tasks_from: install

    - name: Copy CA and server/peer certs
      ansible.builtin.copy:
        src: "{{ etcd_pki_local_dir }}/{{ item.src }}"
        dest: "{{ etcd_pki_dir }}/{{ item.dest }}"
        owner: etcd
        group: etcd
        mode: "{{ item.mode }}"
      loop:
        - { src: "ca.crt",                                  dest: "ca.crt",     mode: "0644" }
        - { src: "server-{{ inventory_hostname }}.crt",     dest: "server.crt", mode: "0644" }
        - { src: "server-{{ inventory_hostname }}.key",     dest: "server.key", mode: "0600" }
        - { src: "peer-{{ inventory_hostname }}.crt",       dest: "peer.crt",   mode: "0644" }
        - { src: "peer-{{ inventory_hostname }}.key",       dest: "peer.key",   mode: "0600" }

- name: Register new etcd member in cluster
  hosts: "{{ (groups['etcd_nodes'] | default([]) | reject('equalto', node_to_add | default('')) | list)[0] | default('') }}"
  gather_facts: false
  become: true
  when:
    - k3s_etcd_type | default('embedded') == 'external'
    - groups['etcd_nodes'] is defined
    - node_to_add in groups['etcd_nodes']
    - (groups['etcd_nodes'] | reject('equalto', node_to_add) | list) | length > 0
  tags: [etcd]
  tasks:
    - name: Add member via etcdctl
      ansible.builtin.shell: |
        ETCDCTL_API=3 etcdctl \
          --endpoints="https://{{ ansible_host }}:{{ etcd_client_port }}" \
          --cacert="{{ etcd_pki_dir }}/ca.crt" \
          --cert="{{ etcd_pki_dir }}/server.crt" \
          --key="{{ etcd_pki_dir }}/server.key" \
          member add "{{ node_to_add }}" \
          --peer-urls="https://{{ hostvars[node_to_add]['ansible_host'] }}:{{ etcd_peer_port }}"
      changed_when: true

- name: Start etcd on new etcd member
  hosts: "{{ node_to_add }}"
  gather_facts: true
  become: true
  when:
    - k3s_etcd_type | default('embedded') == 'external'
    - groups['etcd_nodes'] is defined
    - node_to_add in groups['etcd_nodes']
  tags: [etcd]
  vars:
    etcd_initial_cluster_state: "existing"
  tasks:
    - name: Build cluster members string
      ansible.builtin.set_fact:
        etcd_initial_cluster_members: >-
          {%- set members = [] -%}
          {%- for h in groups['etcd_nodes'] -%}
            {%- set _ = members.append(h ~ '=https://' ~ hostvars[h]['ansible_host'] ~ ':' ~ etcd_peer_port) -%}
          {%- endfor -%}
          {{ members | join(',') }}

    - name: Deploy etcd environment and start service
      ansible.builtin.include_role:
        name: etcd
        tasks_from: service