K3S/playbooks/k8s-user.yml

---
# ─────────────────────────────────────────────────────────────────────────────
# k8s-user: создание сервисных пользователей из списка cluster_service_users
#
# Обрабатывает ЛЮБОЕ количество пользователей из списка в group_vars.
# Для каждого пользователя:
#   1. Создать на всех нодах кластера (пользователь + sudo)
#   2. Сгенерировать RSA 4096 ключевую пару на первом мастере
#   3. Сохранить ключи локально в ./keys/<user>_id_rsa
#   4. Разложить ключи на все ноды кластера
#   5. Обновить /etc/hosts на нодах кластера
#   6. То же самое для lab_hosts (через bootstrap credentials из vault)
#
# Настройка пользователей: group_vars/all/main.yml → cluster_service_users
#
# Запуск: ansible-playbook playbooks/k8s-user.yml --ask-vault-pass
# Только кластер: ansible-playbook playbooks/k8s-user.yml --limit k3s_cluster
# ─────────────────────────────────────────────────────────────────────────────

# ── 1. Создать всех пользователей на нодах кластера ──────────────────────────
- name: Create service users on cluster nodes
  hosts: k3s_cluster
  gather_facts: true
  become: true
  tasks:
    - name: Create user {{ item.name }}
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: create_user.yml
      vars:
        k8s_service_user: "{{ item.name }}"
        k8s_service_user_comment: "{{ item.comment | default(item.name) }}"
        k8s_service_user_shell: "{{ item.shell | default('/bin/bash') }}"
        k8s_service_user_sudo: "{{ item.sudo | default(true) }}"
        k8s_service_user_ssh_dir: "{{ item.ssh_dir | default('.ssh') }}"
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

# ── 2. Сгенерировать ключевые пары для всех пользователей (первый мастер) ────
- name: Generate SSH key pairs for all users
  hosts: "{{ groups['k3s_master'][0] }}"
  gather_facts: false
  become: true
  tasks:
    - name: Generate key pair for {{ item.name }}
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: generate_keys.yml
      vars:
        k8s_service_user: "{{ item.name }}"
        k8s_service_user_key_type: "{{ item.key_type | default('rsa') }}"
        k8s_service_user_key_bits: "{{ item.key_bits | default(4096) }}"
        k8s_service_user_key_comment: "{{ item.key_comment | default(item.name + '@cluster') }}"
        k8s_service_user_ssh_dir: "{{ item.ssh_dir | default('.ssh') }}"
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

# ── 3. Сохранить все ключи локально в ./keys/ ────────────────────────────────
- name: Save SSH keys to local machine
  hosts: "{{ groups['k3s_master'][0] }}"
  gather_facts: false
  tasks:
    - name: Create local keys directory
      ansible.builtin.file:
        path: "{{ k8s_local_keys_dir }}"
        state: directory
        mode: '0700'
      delegate_to: localhost
      become: false

    - name: Save private key for {{ item.name }}
      ansible.builtin.copy:
        content: "{{ hostvars[inventory_hostname][item.name + '_ssh_private_key'] }}"
        dest: "{{ k8s_local_keys_dir }}/{{ item.name }}_id_rsa"
        mode: '0600'
      delegate_to: localhost
      become: false
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

    - name: Save public key for {{ item.name }}
      ansible.builtin.copy:
        content: "{{ hostvars[inventory_hostname][item.name + '_ssh_public_key'] }}\n"
        dest: "{{ k8s_local_keys_dir }}/{{ item.name }}_id_rsa.pub"
        mode: '0644'
      delegate_to: localhost
      become: false
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

    - name: Show saved key locations
      ansible.builtin.debug:
        msg: "Keys saved: {{ k8s_local_keys_dir }}/{{ item.name }}_id_rsa"
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

# ── 4. Разложить ключи на все ноды кластера ──────────────────────────────────
- name: Distribute SSH keys to all cluster nodes
  hosts: k3s_cluster
  gather_facts: false
  become: true
  tasks:
    - name: Deploy keys for {{ item.name }}
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: distribute_keys.yml
      vars:
        k8s_service_user: "{{ item.name }}"
        k8s_service_user_ssh_dir: "{{ item.ssh_dir | default('.ssh') }}"
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

# ── 5. Обновить /etc/hosts на нодах кластера (один раз на хост) ──────────────
- name: Update /etc/hosts on cluster nodes
  hosts: k3s_cluster
  gather_facts: false
  become: true
  tasks:
    - name: Update hosts file
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: update_hosts.yml

# ── 6. Настроить всё на lab_hosts (через bootstrap credentials из vault) ──────
- name: Setup service users on lab hosts
  hosts: lab_hosts
  gather_facts: true
  become: true
  vars:
    ansible_user: "{{ bootstrap_user }}"
    ansible_password: "{{ bootstrap_password }}"
    ansible_become_password: "{{ bootstrap_sudo_password | default(bootstrap_password) }}"
    ansible_ssh_common_args: >-
      -o StrictHostKeyChecking=no
      -o PasswordAuthentication=yes
      -o PubkeyAuthentication=no
  tasks:
    - name: Create user {{ item.name }} on lab host
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: create_user.yml
      vars:
        k8s_service_user: "{{ item.name }}"
        k8s_service_user_comment: "{{ item.comment | default(item.name) }}"
        k8s_service_user_shell: "{{ item.shell | default('/bin/bash') }}"
        k8s_service_user_sudo: "{{ item.sudo | default(true) }}"
        k8s_service_user_ssh_dir: "{{ item.ssh_dir | default('.ssh') }}"
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

    - name: Deploy keys for {{ item.name }} on lab host
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: distribute_keys.yml
      vars:
        k8s_service_user: "{{ item.name }}"
        k8s_service_user_ssh_dir: "{{ item.ssh_dir | default('.ssh') }}"
      loop: "{{ cluster_service_users }}"
      loop_control:
        label: "{{ item.name }}"

    - name: Update /etc/hosts on lab host
      ansible.builtin.include_role:
        name: k8s-user
        tasks_from: update_hosts.yml

- name: Configure time synchronization on lab hosts
  hosts: lab_hosts
  gather_facts: true
  become: true
  vars:
    ansible_user: "{{ bootstrap_user }}"
    ansible_password: "{{ bootstrap_password }}"
    ansible_become_password: "{{ bootstrap_sudo_password | default(bootstrap_password) }}"
    ansible_ssh_common_args: >-
      -o StrictHostKeyChecking=no
      -o PasswordAuthentication=yes
      -o PubkeyAuthentication=no
  roles:
    - role: chrony