Without the chart: Ansible
demo/k3s/ansible/deploy.yml creates the objects the chart renders with
several replicas, ban.backend: configmap, the shared Secret, the cluster
channel, the control door and cluster.unreadyWhen: auto, for a cluster
deployed by Ansible rather than Helm.
ansible-galaxy collection install kubernetes.core
pip install kubernetes
ansible-playbook demo/k3s/ansible/deploy.yml -e ns=files -e release=gate \
-e config_file=config.toml -e replicas=3
config_file is the config.toml the chart would take as config.inline:
listeners on 0.0.0.0, backend = "configmap" under [sftp.ban],
[api.ban] and [admin.ban] (those of ban_lists), allow_static_token = false under [admin]
(the chart writes it), host_keys under /keys, from the
<release>-host-keys Secret, which you create.
| Object | As the chart |
|---|---|
ServiceAccount <release> | its token mounted (automountServiceAccountToken: true): the pods read and write the objects below through the Kubernetes API |
Roles <release>-bans, <release>-access | get, update, patch on that one ConfigMap; watch on the collection for the bans (a watch cannot name an object) |
Role <release>-cluster-secret | get, update on that one Secret |
Secret <release>-cluster, ConfigMaps <release>-bans, <release>-access | created empty, only when absent: the pods write their entries, a later run leaves them alone |
ConfigMap <release>-config | config.toml, mounted whole on /config |
Services <release> (SFTP), <release>-api (file API), <release>-control (console, /metrics, probes) | TCP, ClusterIP (sftp_service_type, admin_service_type, control_service_type) |
Service <release>-cluster | headless, publishNotReadyAddresses: true: a pod withdrawn by the detectors stays a peer |
NetworkPolicy <release> | SFTP and file API from any source; control port from the cluster’s pods; cluster port from the release’s pods |
Deployment <release> | the chart’s CRAFT_FILE_GATE_* variables (control port, Secret, revocations, grants, one per ban list of ban_lists, cluster channel, min_peers, unready_when, hashing threads from requests.cpu); probes startupProbe and livenessProbe on /livez, readinessProbe on /readyz, all on the control port; the chart’s security context; termination_grace_secs: shutdown_grace_period_secs plus 60 s, 90 by default |
No Role holds create: on a collection, it would cover every object of the
namespace. Variables, defaults and their names: the top of deploy.yml.
Checking it against the chart
demo/k3s/demo.sh deploy ansible # the playbook, in a container, against the demo's k3s
demo/k3s/demo.sh check ansible
check ansible compares each object, with the defaults the API server
adds, with the chart rendered from the same inputs (the values of the
cluster mode, a server-side dry run), then plays the
scenario on its pods. It prints
the 17 objects of the chart, identical, or the differences.