150 lines
4.9 KiB
YAML
150 lines
4.9 KiB
YAML
---
|
|
- name: Verify the PostgreSQL datastore through the VyOS endpoint
|
|
hosts: k3s_cluster
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Query the K3s database through the stable endpoint
|
|
community.postgresql.postgresql_query:
|
|
login_host: "{{ sandbox_postgresql_lb_address }}"
|
|
login_db: "{{ sandbox_postgresql_database }}"
|
|
login_user: "{{ sandbox_postgresql_user }}"
|
|
login_password: "{{ sandbox_postgresql_k3s_password }}"
|
|
query: SELECT NOT pg_is_in_recovery() AS writable
|
|
register: sandbox_datastore_endpoint
|
|
no_log: true
|
|
|
|
- name: Assert the stable datastore endpoint is writable
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_datastore_endpoint.query_result[0].writable
|
|
fail_msg: The VyOS datastore endpoint is not connected to a writable PostgreSQL primary
|
|
quiet: true
|
|
|
|
- name: Verify synchronous PostgreSQL replication
|
|
hosts: postgres_primary
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Query replication state on the primary
|
|
community.postgresql.postgresql_query:
|
|
login_db: postgres
|
|
query: >-
|
|
SELECT application_name, state, sync_state
|
|
FROM pg_stat_replication
|
|
WHERE application_name = 'sandbox2'
|
|
become: true
|
|
become_user: postgres
|
|
register: sandbox_replication_state
|
|
|
|
- name: Assert sandbox2 is a synchronous streaming standby
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_replication_state.query_result | length == 1
|
|
- sandbox_replication_state.query_result[0].state == 'streaming'
|
|
- sandbox_replication_state.query_result[0].sync_state == 'sync'
|
|
fail_msg: sandbox2 is not synchronously streaming from sandbox1
|
|
quiet: true
|
|
|
|
- name: Verify PostgreSQL standby recovery state
|
|
hosts: postgres_standby
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Query recovery state on the standby
|
|
community.postgresql.postgresql_query:
|
|
login_db: postgres
|
|
query: SELECT pg_is_in_recovery() AS in_recovery
|
|
become: true
|
|
become_user: postgres
|
|
register: sandbox_standby_state
|
|
|
|
- name: Assert sandbox2 remains in recovery
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_standby_state.query_result[0].in_recovery
|
|
fail_msg: sandbox2 is not operating as a PostgreSQL standby
|
|
quiet: true
|
|
|
|
- name: Verify K3s node prerequisites
|
|
hosts: k3s_cluster
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Read the kmsg mapping
|
|
ansible.builtin.command:
|
|
cmd: readlink /dev/kmsg
|
|
register: sandbox_kmsg_target
|
|
changed_when: false
|
|
|
|
- name: Inspect the host kernel module mount
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
set -o pipefail &&
|
|
findmnt -rn -T "/lib/modules/$(uname -r)" -o OPTIONS |
|
|
grep -Eq '(^|,)ro(,|$)'
|
|
executable: /bin/bash
|
|
changed_when: false
|
|
|
|
- name: Assert required LXC kernel integration
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_kmsg_target.stdout == '/dev/console'
|
|
fail_msg: LXC is missing its persistent kmsg or read-only host module mapping
|
|
quiet: true
|
|
|
|
- name: Read K3s service state
|
|
ansible.builtin.systemd_service:
|
|
name: k3s
|
|
register: sandbox_k3s_service
|
|
|
|
- name: Assert K3s is active
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_k3s_service.status.ActiveState == 'active'
|
|
- sandbox_k3s_service.status.SubState == 'running'
|
|
fail_msg: K3s is not running
|
|
quiet: true
|
|
|
|
- name: Verify the K3s control plane and API VIP
|
|
hosts: sandbox1
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Wait for all declared nodes
|
|
ansible.builtin.command:
|
|
cmd: k3s kubectl wait --for=condition=Ready nodes --all --timeout=120s
|
|
changed_when: false
|
|
|
|
- name: Read control-plane nodes
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
k3s kubectl get nodes
|
|
-l node-role.kubernetes.io/control-plane=true
|
|
-o name
|
|
register: sandbox_control_plane_nodes
|
|
changed_when: false
|
|
|
|
- name: Assert both control-plane nodes are registered
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_control_plane_nodes.stdout_lines | length == 2
|
|
fail_msg: The sandbox cluster does not contain both control-plane nodes
|
|
quiet: true
|
|
|
|
- name: Wait for all kube-system Pods
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
k3s kubectl wait --namespace kube-system
|
|
--for=condition=Ready pods --all --timeout=120s
|
|
changed_when: false
|
|
|
|
- name: Verify the authenticated API path through VyOS
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
k3s kubectl --server=https://10.60.0.13:6443 get --raw=/livez
|
|
register: sandbox_api_livez
|
|
changed_when: false
|
|
|
|
- name: Assert the API VIP is live
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sandbox_api_livez.stdout == 'ok'
|
|
fail_msg: The K3s API is not healthy through the VyOS VIP
|
|
quiet: true
|