02-rancher-upstream.yml

---
- name: Install dependencies
  hosts: cloud
  tags: dependencies
  tasks:
    - name: Ensure Python3 pip is installed
      become: true
      ansible.builtin.package:
        name: python3-pip
        state: present

    - name: Install Python Kubernetes modules
      become: true
      ansible.builtin.pip:
        name:
          - kubernetes
          - pyyaml
        state: present

    - name: Install Longhorn dependencies
      become: true
      ansible.builtin.package:
        name:
          - open-iscsi
          - nfs-client
          - nfs-common
        state: present

    - name: Enable iscsid service
      become: true
      ansible.builtin.service:
        name: iscsid
        enabled: true
        state: started

- name: Set up a rke2 cluster for Rancher
  hosts: rancher
  tags: upstream, rancher, rke2
  roles:
    - { role: diademiemi.rke2, tags: ["rke2", "deploy"]}
    - { role: diademiemi.helm, tags: ["helm", "deploy"]}

- name: Generate bootstrap password
  hosts: localhost, rancher
  tags: rancher, always
  tasks:
    - name: Generate bootstrap password
      ansible.builtin.set_fact:
        rancher_bootstrap_password: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"
      when: rancher_bootstrap_password is not defined
      delegate_to: localhost
      run_once: true

- name: Set up and bootstrap Rancher
  hosts: rancher
  tags: upstream, rancher, bootstrap
  tasks:
    # https://ranchermanager.docs.rancher.com/getting-started/quick-start-guides/deploy-rancher-manager/helm-cli
    - name: Add cert-manager repository
      become: true
      kubernetes.core.helm_repository:
        name: "jetstack"
        repo_url: "https://charts.jetstack.io"

    - name: Add Rancher Helm repository
      become: true
      kubernetes.core.helm_repository:
        name: "rancher-{{ rancher_release_type }}"
        repo_url: "https://releases.rancher.com/server-charts/{{ rancher_release_type }}"

    - name: Install cert-manager
      become: true
      kubernetes.core.helm:
        kubeconfig: "{{ kubeconfig_path }}"
        chart_ref: "jetstack/cert-manager"
        chart_version: "v1.12.0"  # Supported by Rancher
        release_name: "cert-manager"
        namespace: "cert-manager"
        create_namespace: true
        values:
          installCRDs: true

    - name: Install Rancher
      become: true
      kubernetes.core.helm:
        kubeconfig: "{{ kubeconfig_path }}"
        chart_ref: "rancher-{{ rancher_release_type }}/rancher"
        chart_version: "{{ rancher_version }}"  # Supported by Rancher
        release_name: "rancher"
        namespace: "cattle-system"
        create_namespace: true
        values:
          replicas: 1
          hostname: "{{ ansible_facts['fqdn'] }}"
          bootstrapPassword: "{{ rancher_bootstrap_password }}"
          ingress:
            enabled: true
          global:
            cattle:
              psp:
                enabled: false # For rke2

    - name: Wait for rancher to be ready
      become: true
      kubernetes.core.k8s_info:
        kubeconfig: "{{ kubeconfig_path }}"
        kind: "Deployment"
        api_version: "apps/v1"
        namespace: "cattle-system"
        label_selectors:
          - "app=rancher"
      register: rancher_deployment
      retries: 60
      delay: 5
      until: |
        rancher_deployment.resources | length > 0 and
        rancher_deployment.resources[0].status is defined and
        rancher_deployment.resources[0].status.replicas is defined and
        rancher_deployment.resources[0].status.readyReplicas is defined and
        rancher_deployment.resources[0].status.readyReplicas == rancher_deployment.resources[0].status.replicas

    - name: "Give Bootstrap password"
      ansible.builtin.debug:
        msg: "Rancher server is running. Access it at `{{ ansible_facts['fqdn'] }}`
          The bootstrap password is `{{ rancher_bootstrap_password }}`"

...