run.yaml

---

- name: Setup OpenWrt router
  hosts: router
  gather_facts: false
  remote_user: root
  tags:
    - never
    - openwrt
  roles:
    - role: openwrt

- name: Configure base OS
  hosts: metal
  tags:
    - controllers
    - workers
  roles:
    - role: configure-os

- name: Setup backups
  hosts: backups
  tags:
    - backups
  roles:
    - role: backups

- name: configure node
  hosts:
    - controllers
    - workers
  tags:
    - cluster
    - runtime
  roles:
    - role: kube-vip
      tags:
        - vip
      when:
        - inventory_hostname in groups['controllers']
    - role: containerd
      when: k8s_runtime == 'containerd'
    - role: crio
      when: k8s_runtime == 'crio'
    - role: kubernetes
      tags:
        - k8s

- name: Install Helm
  hosts:
    - controllers
  tags:
    - cluster
    - helm
  roles:
    - role: helm

- name: configure CNI
  hosts:
    - controllers
  tags:
    - cluster
    - cni
  roles:
    - role: cilium
      when:
        - k8s_cni == 'cilium'
        - inventory_hostname in k8s_controller

- name: Install nvidia drivers as needed
  hosts:
    - workers
  vars:
    nvidia_id: 10de
    has_nvidia_card: false
  tags:
    - nvidia
  pre_tasks:
    - name: check for nvidia card
      ansible.builtin.command:
        cmd: "lspci -d {{ nvidia_id }}:"
      register: nvidia_devices

    - name: register has_nvidia_card
      ansible.builtin.set_fact:
        has_nvidia_card: true
      when: '"VGA" in nvidia_devices.stdout'
  roles:
    - role: nvidia
      when: has_nvidia_card

- name: Deploy MetalLB 
  hosts:
    - controllers
  tags:
    - lb
    - metallb
  roles:
    - role: metallb
      when:
        - inventory_hostname in k8s_controller

- name: Deploy Sealed Secrets
  hosts:
    - controllers
  tags:
    - cd
    - secrets
  roles:
    - role: sealed-secrets
      when: 
        - inventory_hostname in k8s_controller

- name: Deploy Argo CD
  hosts:
    - controllers
  tags:
    - cd
    - argo
  roles:
    - role: argo
      when:
        - inventory_hostname in k8s_controller

- name: Deploy cert-manager
  hosts:
    - controllers
  tags:
    - certs
  roles:
    - role: cert-manager
      when:
        - inventory_hostname in k8s_controller

- name: Deploy ingress-nginx
  hosts:
    - ingress
  tags:
    - ingress
  roles:
    - role: ingress-nginx
      when: "'ingress-nginx' in ingress_controllers"

- name: Wipe ceph drives
  hosts:
    - controllers
    - workers
  tags:
    - never
    - yes-really-wipe-the-ceph-drives
  tasks:
    - include_tasks: roles/rook/tasks/format-disks.yaml

- name: Deploy Rook ceph
  hosts:
    - controllers
    - workers
  tags:
    - storage
    - rook
    - ceph
  roles:
    - role: chrony
    - role: rook

- name: Deploy Free IPA
  hosts:
    - freeipa
  tags:
    - apps
    - ipa
  roles:
    - role: freeipa

- name: Deploy Domain config
  hosts:
    - freeipa
  tags:
    - config
    - domain
  connection: local
  become: false
  roles:
    - role: domain

- name: Deploy Keycloak
  hosts:
    - controllers
  tags:
    - auth
    - config
  roles:
    - role: keycloak
      when:
      - inventory_hostname in k8s_controller

- name: Deploy Harbor
  hosts:
    - harbor
  tags:
    - harbor
  roles:
    - role: harbor

- name: Deploy gitea
  hosts:
    - gitea
  tags:
    - apps
    - gitea
  roles:
    - role: gitea

...