Updated homelab hosts & structure

2026-08-14 00:17:50 +02:00
parent bb8b9602f2
commit 097ee79bed
23 changed files with 506 additions and 0 deletions
@@ -0,0 +1,59 @@
+Role Name
+=========
+
+This role is here to patch entire Proxmox Clusters at once, be sure to only target one Cluster per execution.
+
+Requirements
+------------
+
+Create a default HA Group called CB-Default, where all not ha-managed vms will be put in.
+
+Be sure to have the Person on Call informed, that you will do patches ;-) 
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+```
+all:
+  children:
+    proxmox:
+        children:
+            homelab:
+                hosts:
+                    pve01:
+                        ansible_host: 172.22.222.201
+                    pve02:
+                        ansible_host: 172.22.222.202
+                    pve03:
+                        ansible_host: 172.22.222.203
+                    pve04:
+                        ansible_host: 172.22.222.204
+                vars:
+                    Datacenter_Location: PLZ8912
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+
+
+Usage
+-----
+ansible-playbook -l homelab playbooks/proxmox-patching.yml
@@ -0,0 +1,8 @@
+---
+# defaults file for ./playbooks/roles/proxmox-patching
+long_task: # 40x 15s  => 10 Minutes
+  retries: 40
+  delay: 15
+pve:
+  # All vms in no ha_group will be added to the default.
+  default_cluster_balance_group: CB-Default
@@ -0,0 +1,2 @@
+---
+# handlers file for ./playbooks/roles/proxmox-patching
@@ -0,0 +1,52 @@
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
@@ -0,0 +1,93 @@
+---
+# Ensure Ceph is healthy, before starting to patch
+- name: Ensure Ceph is HEALTH_OK and no rebalancing
+  shell: |
+    ceph status | grep 'HEALTH_OK' && ! ceph status | grep -q -e 'degraded' -e 'remapped'
+  register: ceph_health
+  failed_when: ceph_health.rc != 0
+  delegate_to: "{{ play_hosts[0] }}"
+# Ensure no node is in Maintenance Mode before patching
+- name: Ensure no node is in mainteance mode
+  shell: ha-manager status | grep '^lrm ' | grep -e maintenance | wc -l
+  register: no_node_maintenance
+  failed_when: no_node_maintenance.stdout|int != 0
+  delegate_to: "{{ play_hosts[0] }}"
+# Check that all VMs are in a HA Group, so they will be migrated when the host gets set to maintenance Mode
+- name: Ensure all VMs are in a HA Group
+  shell: |
+    for res in $(pvesh get /cluster/resources -type vm --output-format json|jq '.[]|select(has("hastate")|not)|.vmid'); do ha-manager add $res ;done
+
+- block:
+    # Set the noout flag to ensure no data on ceph is moved, while a host is unavailable
+    - name: Set Ceph noout flag (only first run)
+      shell: ceph osd set noout
+    # Enable the maintenance Mode of the Host
+    - name: Enable maintenance mode and migrate VMs
+      shell:  ha-manager crm-command node-maintenance enable {{ inventory_hostname }}
+      ignore_errors: false
+
+    # Wait till all resources are migrate away 
+    - name: Wait until no VMs are running on this host
+      shell: |
+        qm list | grep running | wc -l
+      register: vm_count
+      changed_when: false
+      retries: "{{ long_task.retries }}"
+      delay: "{{ long_task.delay }}"
+      until: vm_count.stdout|int == 0
+    - name: Wait until no LXCs are running on this host
+      shell: |
+        pct list | grep running | wc -l
+      register: lxc_count
+      changed_when: false
+      retries: "{{ long_task.retries }}"
+      delay: "{{ long_task.delay }}"
+      until: lxc_count.stdout|int == 0
+
+    # Install latest Packages
+    - name: Update apt packages
+      apt:
+        update_cache: yes
+        upgrade: dist
+        autoremove: yes
+
+    # Compare if the current running kernel is the same as the latest kernel
+    - name: Get expected boot kernel version
+      shell: |
+        grep vmlinuz /boot/grub/grub.cfg | head -1 | awk '{ print $2 }' | sed -e 's%/boot/vmlinuz-%%;s%/ROOT/pve-1@%%'
+      register: boot_kernel
+      changed_when: false
+    - name: Get currently running kernel version
+      shell: uname -r
+      register: running_kernel
+      changed_when: false
+    # If a newer kernel is on the system, then reboot
+    - name: Reboot if required
+      reboot:
+        reboot_timeout: 600
+        post_reboot_delay: 60
+      when: boot_kernel.stdout.strip() != running_kernel.stdout.strip()
+
+
+    # Disable Ceph noout, as soon as the host is online
+    - name: Unset Ceph noout flag
+      shell: ceph osd unset noout
+    
+    - name: Ensure Ceph is HEALTH_OK again
+      shell: |
+        ceph status | grep 'HEALTH_OK' && ! ceph status | grep -q -e 'degraded' -e 'remapped'
+      register: ceph_health
+      retries: "{{ long_task.retries }}"
+      delay: "{{ long_task.delay }}"
+      failed_when: ceph_health.rc != 0
+      delegate_to: "{{ play_hosts[0] }}"
+
+    - name: Disable maintenance mode and migrate VMs
+      shell:  ha-manager crm-command node-maintenance disable {{ inventory_hostname }}
+      ignore_errors: false
+    - name: Ensure no node is in mainteance mode
+      shell: ha-manager status | grep '^lrm ' | grep -e maintenance | wc -l
+      register: no_node_maintenance
+      failed_when: no_node_maintenance.stdout|int != 0
+      retries: "{{ long_task.retries }}"
+      delay: "{{ long_task.delay }}"
@@ -0,0 +1,8 @@
+---
+- name: Distribution not found
+  debug:
+    msg:
+    - "OS Family: {{ ansible_os_family }}"
+    - "OS Distro: {{ ansible_distribution }}"
+    - "OS Major Version: {{ ansible_distribution_major_version }}"
+    - "OS Version: {{ ansible_distribution_version }}"
@@ -0,0 +1,31 @@
+---
+# tasks file for ./playbooks/roles/proxmox-patching
+- name: Import variables specific to distribution
+  include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ role_path }}/vars/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_facts['distribution'] }}.yml"
+    # ansible_os_family is used as a fallback for distros which are not currently
+    # supported, but are based on a supported distro family. For example,
+    # Oracle, Rocky, Alma and Alibaba linux, which are all "RedHat" based.
+    - "{{ role_path }}/vars/{{ ansible_facts['os_family'] }}-{{ ansible_facts['distribution_version'] }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_facts['os_family'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"
+    - "{{ role_path }}/vars/{{ ansible_facts['os_family'] }}.yml"
+    # If neither distro nor family is supported, try a default configuration.
+    - "{{ role_path }}/vars/default.yml"
+
+- name: Update everything for distribution
+  include_tasks: "{{ item }}"
+  with_first_found:
+    - "{{ role_path }}/tasks/dist/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}.yml"
+    - "{{ role_path }}/tasks/dist/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"
+    - "{{ role_path }}/tasks/dist/{{ ansible_facts['distribution'] }}.yml"
+    # ansible_os_family is used as a fallback for distros which are not currently
+    # supported, but are based on a supported distro family. For example,
+    # Oracle, Rocky, Alma and Alibaba linux, which are all "RedHat" based.
+    - "{{ role_path }}/tasks/dist/{{ ansible_facts['os_family'] }}-{{ ansible_facts['distribution_version'] }}.yml"
+    - "{{ role_path }}/tasks/dist/{{ ansible_facts['os_family'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"
+    - "{{ role_path }}/tasks/dist/{{ ansible_facts['os_family'] }}.yml"
+    # If neither distro nor family is supported, try a default configuration.
+    - "{{ role_path }}/tasks/dist/no_dist_found.yml"
@@ -0,0 +1,2 @@
+localhost
+
@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - ./playbooks/roles/proxmox-patching
@@ -0,0 +1,2 @@
+---
+# vars file for ./playbooks/roles/proxmox-patching