Proxmox VE + Amazon EKS Distro + Rancher 混合雲容器平台落地指南 ¶

apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: "192.168.30.101"
  bindPort: 6443
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: "v1.30.2"
controlPlaneEndpoint: "192.168.30.100:6443" # 指向 VIP
# 核心映像檔全數來源於 AWS 官方 Public ECR
imageRepository: "public.ecr.aws/eks-distro/kubernetes"
dns:
  imageRepository: "public.ecr.aws/eks-distro/coredns"
  imageTag: "v1.11.1-eks-1-30-1"
etcd:
  local:
    imageRepository: "public.ecr.aws/eks-distro/etcd-io"
    imageTag: "v3.5.14-eks-1-30-1"
networking:
  podSubnet: "10.244.0.0/16"
  serviceSubnet: "10.96.0.0/12"

---
- name: Zero-Touch Provisioning of EKS-D on Proxmox and Auto-Import to Rancher
  hosts: localhost
  gather_facts: false
  vars:
    pve_api_host: "192.168.10.11"
    pve_api_user: "root@pam"
    pve_template_id: 9000
    cluster_name: "{{ target_cluster_name | default('eksd-dev-01') }}"
    rancher_url: "https://rancher.internal.domain"
    rancher_token: "{{ lookup('env', 'RANCHER_BEARER_TOKEN') }}"

  tasks:
    # -------------------------------------------------------------
    # 階段 1：透過 Proxmox API 自動克隆並開機虛擬機
    # -------------------------------------------------------------
    - name: Clone Master and Worker VMs from Cloud-Init Template
      community.general.proxmox_kvm:
        api_host: "{{ pve_api_host }}"
        api_user: "{{ pve_api_user }}"
        api_token_id: "{{ lookup('env', 'PVE_TOKEN_ID') }}"
        api_token_secret: "{{ lookup('env', 'PVE_TOKEN_SECRET') }}"
        node: "pve-01"
        clone: "{{ pve_template_id }}"
        name: "{{ item.name }}"
        vmid: "{{ item.vmid }}"
        memory: "{{ item.memory }}"
        cores: "{{ item.cores }}"
        net0: "virtio,bridge=vmbr0"
        ipconfig0: "ip={{ item.ip }}/24,gw=192.168.30.1"
        state: started
      loop:
        - { name: "{{ cluster_name }}-cp-01", vmid: 401, cores: 4, memory: 8192, ip: "192.168.30.101" }
        - { name: "{{ cluster_name }}-worker-01", vmid: 411, cores: 8, memory: 16384, ip: "192.168.30.111" }
        - { name: "{{ cluster_name }}-worker-02", vmid: 412, cores: 8, memory: 16384, ip: "192.168.30.112" }

    - name: Wait for VMs to be reachable via SSH
      ansible.builtin.wait_for:
        host: "192.168.30.101"
        port: 22
        timeout: 180

- name: Bootstrap Amazon EKS Distro Cluster
  hosts: "{{ cluster_name }}-cp-01"
  tasks:
    - name: Install containerd and EKS-D components
      ansible.builtin.include_role:
        name: eks_distro_bootstrap

    - name: Initialize Kubernetes Control Plane
      ansible.builtin.command: >
        kubeadm init
        --image-repository public.ecr.aws/eks-distro/kubernetes
        --pod-network-cidr 10.244.0.0/16
      args:
        creates: /etc/kubernetes/admin.conf

    - name: Install Cilium CNI
      ansible.builtin.command: >
        cilium install --version 1.15.5
      environment:
        KUBECONFIG: /etc/kubernetes/admin.conf

- name: Register and Auto-Import EKS-D Cluster to Rancher
  hosts: localhost
  tasks:
    # -------------------------------------------------------------
    # 階段 2：呼叫 Rancher REST API 建立匯入型叢集並取得 Registration YAML
    # -------------------------------------------------------------
    - name: Create Generic Cluster entry in Rancher
      ansible.builtin.uri:
        url: "{{ rancher_url }}/v3/clusters"
        method: POST
        headers:
          Authorization: "Bearer {{ rancher_token }}"
          Content-Type: "application/json"
        body_format: json
        body:
          name: "{{ cluster_name }}"
          description: "Auto-provisioned EKS-D cluster on Proxmox via AWX"
        status_code: [201]
      register: rancher_cluster_resp

    - name: Extract Created Cluster ID
      ansible.builtin.set_fact:
        rancher_cluster_id: "{{ rancher_cluster_resp.json.id }}"

    - name: Retrieve Cluster Registration Token and Import Manifest
      ansible.builtin.uri:
        url: "{{ rancher_url }}/v3/clusterregistrationtokens?clusterId={{ rancher_cluster_id }}"
        method: GET
        headers:
          Authorization: "Bearer {{ rancher_token }}"
        status_code: [200]
      register: reg_tokens
      until: reg_tokens.json.data | length > 0
      retries: 10
      delay: 3

    - name: Save Import Manifest URL
      ansible.builtin.set_fact:
        import_manifest_url: "{{ reg_tokens.json.data[0].manifestUrl }}"

    # -------------------------------------------------------------
    # 階段 3：在新建立的 EKS-D 叢集中套用 Rancher Agent YAML
    # -------------------------------------------------------------
    - name: Deploy Rancher Cluster Agent into EKS-D
      kubernetes.core.k8s:
        src: "{{ import_manifest_url }}"
        state: present
        kubeconfig: /tmp/{{ cluster_name }}-kubeconfig

    - name: Verify Cluster State in Rancher
      ansible.builtin.uri:
        url: "{{ rancher_url }}/v3/clusters/{{ rancher_cluster_id }}"
        method: GET
        headers:
          Authorization: "Bearer {{ rancher_token }}"
      register: cluster_status
      until: cluster_status.json.state == "active"
      retries: 30
      delay: 10

    - name: Output Provisioning Result
      ansible.builtin.debug:
        msg: "EKS-D Cluster {{ cluster_name }} successfully provisioned and active in Rancher!"

---
- name: Automated Worker Scaling for EKS-D
  hosts: localhost
  gather_facts: false
  vars:
    pve_node: "pve-01"
    template_vmid: 9000
    new_worker_name: "{{ target_worker_name }}" # 由 AWX Survey 動態傳入
    new_worker_vmid: "{{ target_worker_vmid }}"
    new_worker_ip: "{{ target_worker_ip }}"

  tasks:
    # 1. 呼叫 Proxmox API 自動克隆開機
    - name: Clone New Worker VM in Proxmox
      community.general.proxmox_kvm:
        node: "{{ pve_node }}"
        clone: "{{ template_vmid }}"
        name: "{{ new_worker_name }}"
        vmid: "{{ new_worker_vmid }}"
        memory: 16384
        cores: 8
        ipconfig0: "ip={{ new_worker_ip }}/24,gw=192.168.30.1"
        state: started

    - name: Wait for SSH Availability
      ansible.builtin.wait_for:
        host: "{{ new_worker_ip }}"
        port: 22
        timeout: 180

    # 2. 連線至 Control Plane 取得新鮮的 join token
    - name: Generate Fresh Join Command
      ansible.builtin.command: kubeadm token create --print-join-command
      delegate_to: "192.168.30.101"
      register: join_cmd_raw

    # 3. 在新 Worker 節點執行加入
    - name: Execute Kubeadm Join on New Worker
      ansible.builtin.command: "{{ join_cmd_raw.stdout }}"
      delegate_to: "{{ new_worker_ip }}"
      become: true

    - name: Apply Worker Label
      ansible.builtin.command: >
        kubectl label node {{ new_worker_name }} node-role.kubernetes.io/worker=true
      delegate_to: "192.168.30.101"