lvrt-lcl-session-srv-430-okd-ipi-provisioner.yml

---
# Copyright (c) 2023 Jakob Meng, <jakobmeng@web.de>
# vim:set fileformat=unix tabstop=2 shiftwidth=2 expandtab:
# kate: end-of-line unix; space-indent on; indent-width 2; remove-trailing-spaces modified;

ansible_host: 192.168.158.28

# Enable SSH agent forwarding for accessing the nested bootstrap virtual machine which is created by OpenShift
# Installer-provisioned installation (IPI)
ansible_ssh_common_args: '-A'

# The bootstrap VM, created by OpenShift Installer-provisioned installation (IPI), is blocked by AppArmor from accessing
# its libvirt storage volume in /var/lib/libvirt/openshift-images/.
apparmor_config:
- ansible.builtin.file:
    group: root
    mode: u=rwx,g=rx,o=rx
    owner: root
    path: /etc/apparmor.d/local/abstractions
    state: directory
- ansible.builtin.copy:
    content: |
      # Grant bootstrap VM from OpenShift Installer-provisioned installation (IPI)
      # access to its libvirt storage volume in /var/lib/libvirt/openshift-images/.
        /var/lib/libvirt/openshift-images/** rwk,
    dest: /etc/apparmor.d/local/abstractions/libvirt-qemu
    mode: u=rw,g=r,o=r
    group: root
    owner: root

# Debian 11 (Bullseye) does not support the baremetal bridge in libvirt_netplan out of the box
distribution_id:
- 'Ubuntu'
- '22.04'

groups_config:
- name: libvirt
  state: present
  system: true

libvirt_domain_autostart: false

libvirt_hardware:
- cpu: 'host-passthrough,cache.mode=passthrough'
- vcpus: '2'
- memory: '12288'
- virt_type: 'kvm'
- graphics: 'vnc,listen=socket'
- network: 'network=route-1-no-dhcp,model=virtio,mac=52:54:00:aa:bb:13'
- disk: "vol='{{ libvirt_pool }}/{{ libvirt_volumes[0]['name'] }}',device=disk,bus=virtio"
- disk: "vol='{{ libvirt_pool }}/{{ libvirt_configdrive }}',device=disk,bus=virtio,serial='cidata'"
- os_variant: 'ubuntu18.04'

libvirt_host_become: false

libvirt_images: []

libvirt_netplan:
  ethernets:
    eth0:
      dhcp4: false
      dhcp6: false
      accept-ra: false
  bridges:
    baremetal:
      interfaces:
      - eth0

      dhcp4: false
      dhcp6: false
      accept-ra: false

      addresses:
      - 192.168.158.28/24

      nameservers:
        search: [okd-ipi.home.arpa, home.arpa]
        addresses:
        - 192.168.158.26
      routes:
      - to: 0.0.0.0/0
        via: 192.168.158.1

libvirt_pool: 'default'

libvirt_uri: 'qemu:///session'

libvirt_volumes:
- backing_vol: 'ubuntu-22.04-server-cloudimg-amd64.img'
  backing_vol_format: 'qcow2'
  capacity: 64G
  format: 'qcow2'
  linked: false
  name: '{{ fqdn }}.qcow2'
  pool: '{{ libvirt_pool }}'
  prealloc_metadata: false
  state: present

openshift_ipi_config: |
  apiVersion: v1
  baseDomain: home.arpa
  metadata:
    name: okd-ipi
  networking:
    machineNetwork:
    - cidr: 192.168.158.0/24
    networkType: OVNKubernetes
  compute:
  - name: worker
    replicas: 2
  controlPlane:
    name: master
    replicas: 3
    platform:
      baremetal: {}
  platform:
    baremetal:
      apiVIPs:
        - 192.168.158.35
      ingressVIPs:
        - 192.168.158.36
      provisioningNetwork: "Disabled"
      bootstrapExternalStaticIP: 192.168.158.99
      # bootstrapExternalStaticGateway will also be used to define DNS nameservers of the bootstrap VM
      bootstrapExternalStaticGateway: 192.168.158.26
      hosts:
        - name: cp0
          role: master
          bmc:
            address: 'redfish-virtualmedia+http://192.168.158.27:8000/redfish/v1/Systems/deadbeef-1337-1337-1337-000000000001'
            username: admin
            password: empty
            disableCertificateVerification: True
          bootMACAddress: 52:54:00:aa:bb:0d
          rootDeviceHints:
            deviceName: "/dev/vda"
        - name: cp1
          role: master
          bmc:
            address: 'redfish-virtualmedia+http://192.168.158.27:8000/redfish/v1/Systems/deadbeef-1337-1337-1337-000000000002'
            username: admin
            password: empty
            disableCertificateVerification: True
          bootMACAddress: 52:54:00:aa:bb:0e
          rootDeviceHints:
            deviceName: "/dev/vda"
        - name: cp2
          role: master
          bmc:
            address: 'redfish-virtualmedia+http://192.168.158.27:8000/redfish/v1/Systems/deadbeef-1337-1337-1337-000000000003'
            username: admin
            password: empty
            disableCertificateVerification: True
          bootMACAddress: 52:54:00:aa:bb:0f
          rootDeviceHints:
            deviceName: "/dev/vda"
        - name: w0
          role: worker
          bmc:
            address: 'redfish-virtualmedia+http://192.168.158.27:8000/redfish/v1/Systems/deadbeef-1337-1337-1337-000000000004'
            username: admin
            password: empty
            disableCertificateVerification: True
          bootMACAddress: 52:54:00:aa:bb:10
          rootDeviceHints:
            deviceName: "/dev/vda"
        - name: w1
          role: worker
          bmc:
            address: 'redfish-virtualmedia+http://192.168.158.27:8000/redfish/v1/Systems/deadbeef-1337-1337-1337-000000000005'
            username: admin
            password: empty
            disableCertificateVerification: True
          bootMACAddress: 52:54:00:aa:bb:11
          rootDeviceHints:
            deviceName: "/dev/vda"
  pullSecret: '{{ openshift_ipi_pullsecret if openshift_ipi_pullsecret != None else openshift_ipi_pullsecret_default }}'
  sshKey: '{{ ssh_authorized_keys
              | selectattr('user', 'equalto', ansible_user)
              | selectattr('state', 'equalto', 'present')
              | map(attribute='key')
              | list | join('\n') }}'

openshift_ipi_oc_checksum: 'sha256:664362e82648a5727dce090ffd545103b9c037d18836527a1951f02b20c12725'

openshift_ipi_oc_url: 'https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.12.4/openshift-client-linux-4.12.4.tar.gz'

openshift_ipi_pullsecret_default: '{"auths":{"xxxxxxx": {"auth": "xxxxxx","email": "xxxxxx"}}}'

openshift_ipi_release_image: 'registry.ci.openshift.org/origin/release-scos:scos-4.12'

# NOTE: Keep in sync with variable users_config from group_vars/all.yml
users_config:
- name: root
  #password: '*'
  password_lock: true
  shell: '/bin/bash'
- name: '{{ ansible_user }}'
  groups:
  - kvm
  - libvirt
  #password: '*'
  password_lock: true
  shell: '/bin/bash'