{"id":20155314,"url":"https://github.com/redhat-cop/k8s_config","last_synced_at":"2025-09-08T20:39:31.173Z","repository":{"id":43502361,"uuid":"229895960","full_name":"redhat-cop/k8s_config","owner":"redhat-cop","description":"Ansible role for managing Kubernetes configuration","archived":false,"fork":false,"pushed_at":"2023-10-03T14:04:49.000Z","size":84,"stargazers_count":9,"open_issues_count":11,"forks_count":2,"subscribers_count":12,"default_branch":"main","last_synced_at":"2025-04-09T22:11:34.907Z","etag":null,"topics":["gpte"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/redhat-cop.png","metadata":{"files":{"readme":"README.adoc","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-12-24T07:42:17.000Z","updated_at":"2022-11-27T23:40:32.000Z","dependencies_parsed_at":"2024-11-13T23:31:41.214Z","dependency_job_id":"799d6732-d404-4a4f-a32d-33dc02bb60f2","html_url":"https://github.com/redhat-cop/k8s_config","commit_stats":null,"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"purl":"pkg:github/redhat-cop/k8s_config","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fk8s_config","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fk8s_config/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fk8s_config/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fk8s_config/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/redhat-cop","download_url":"https://codeload.github.com/redhat-cop/k8s_config/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-cop%2Fk8s_config/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274231504,"owners_count":25245601,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-08T02:00:09.813Z","response_time":121,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gpte"],"created_at":"2024-11-13T23:31:32.714Z","updated_at":"2025-09-08T20:39:31.133Z","avatar_url":"https://github.com/redhat-cop.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":":toc:\n:toc-placement!:\n\n= k8s_config\n\nAnsible role for managing Kubernetes configuration\n\ntoc::[]\n\n== Requirements\n\nAnsible 2.9+\n\nk8s module support\n\n== Installation\n\nInstall with `ansible-galaxy`:\n\n----\nansible-galaxy install redhat-cop.k8s_config\n----\n\nOr install directly from GitHub:\n\n----\nansible-galaxy install git+https://github.com/redhat-cop/k8s_config.git\n----\n\n== Role Variables\n\nKubernetes configuration is specified through role variables.\nThese variables can be stored in the ansible inventory or dynamically loaded with `include_vars` and other methods provided by ansible.\n\n=== Authentication Variables\n\nThe following variables are provided for cluster authentication.\nIf the host kubeconfig is already authenticated to the target cluster then no authentication variables are required.\n\nThese variables map to parameters of the `k8s` and `k8s_info` modules.\n\n* `k8s_api_ca_cert` - Maps to `ca_cert`, which is the certificate provided to identify the client to the server when `client_cert` is also provided.\n\n* `k8s_api_client_cert` - Maps to `client_cert`.\n\n* `k8s_api_client_key` - Maps to `client_key`.\n\n* `k8s_api_token` - Maps to `api_key`.\n\n* `k8s_api_url` - Maps to `host`, which is the cluster API URL.\n\n* `k8s_api_validate_certs` - Maps to `validate_certs`.\n\n* `k8s_kubeconfig` - Maps to `kubeconfig`.\n\nUser and service account tokens are the preferred method of authentication for `k8s_config`,\nThe parameters `k8s_api_username` and `k8s_api_password` may be provided to authenticate to the cluster API to receive a token which will then be used in subsequent API communication.\n\n=== Configuration Variables\n\n==== Configuration Sources\n\nConfiguration sources can be configured with `k8s_config_sources`.\nIf provided, configuration sources will be used to load variables and be added to the search path for files and templates referended in `k8s_config` variables.\n\nSettings for configuration sources:\n\n* `name` -\n  Source name, required.\n\n* `base_path` -\n  Base directory searched for configuration.\n  If not provided then the root of the source git repository is used for git sources.\n  Base path is optional for git config sources but required for local config sources.\n\n* `config_search_path` -\n  List of search paths relative to the base path used to find variables, files, and templates.\n  The values in `config_search_path` are relative to `base_path`.\n  If `config_search_path` is not given in `k8s_config_sources` then it can be provided by defining `k8s_config_search_path` in a `main.yaml` file located in the base path.\n  If no search path is given or discovered, then the base path is added to the search path.\n\n* `git` -\n  Dictionary of parameters passed to the `git` module to clone the git repository.\n  This should at least include `repo`.\n  `key_content` is also supported which will dynamically write a temporary file for the SSH key and pass the path as `key_file`.\n\n* `when` -\n  Optional condition for loading configuration source.\n  This can be useful to conditionally load a configuration source depending on whether credentials are available.\n\n==== Cluster configuration\n\n* `k8s_resources` -\n  List of Kubernetes resource definitions.\n  Resource definitions may be given as dictionaries described below.\n  Namespaced resources given in this variables should include `metadata.namespace`.\n\n* `k8s_namespaces` -\n  Dictionary of Kubernetes namespaces and configuration to apply to the namespace.\n  If a namespace does not exist then it will be created dynamically.\n  OpenShift ProjectRequests are used to create namespace if direct creation is not permitted.\n\n** `resources` - List of Kubernetes resource definitions to apply to the namespace.\n\n==== Resource Definitions:\n\nEach resource definition is given as a dictionary.\nThe presence of the key `definition`, `file`, `helm_template`, `info`, `json_patch`, `namespace`, `openshift_template`, or `template` determines how resource definitions are handled.\nEach resource item may also define `register`, `until`, `retries`, and `delay` which will then be applied to Ansible tasks run for these items.\n\nNOTE: Due to limitations of Ansible, `register` actually sets non-cacheable host facts rather than true registered variables.\nAlso, resource definition evaluation occurs in two passes, the first evaluation occurs before any items are processed and so references to registered variables must be protected with `default` filter or other methods to prevent undefined variable warnings.\nDuring the second pass of evaluation the registered values will be available and will be used in the actual application of the resource definition.\n\n* `namespace` - Namespace specified within `k8s_resources` to provide ordering for namespace creation and resource provisioning.\n\n* `resources` - Included with `namespace`, list of resources to provision into this namespace.\n\n* `action` - Action to take with regard to resources when used with `definition`, `file`, `helm_template`, `openshift_template` or `template`.\nIf `k8s_config_action_override` is defined then that value is used instead.\nIf no `action` is specified then `k8s_config_action_default` is used, which defaults to `apply`.\nValue may be one of:\n** `apply` - Apply resource definitions to create or update resources in manner compatible with `kubectl apply`.\n** `create` - Create resources from definition only if resources do not exist.\n** `delete` - Delete resources from definition if it exists.\n** `merge` - Patch existing resources using merge strategy.\nIf resources do not exist then attempt to create from definition.\n** `replace` - Create or replace resources.\n** `strategic-merge` - Patch existing resources using strategic-merge strategy.\nAutomatically fall back to `merge` if `strategic-merge` is not supported.\nIf resources do not exist then attempt to create from definition.\n\n* `when` - All resources support use of when conditions to control processing.\nFor example, a template may be conditionally processed depending on variables being set.\n\n* `definition` - Direct resource definition within the Ansible variable:\n+\n----\n- name: ConfigMap for myconfig\n  definition:\n    apiVersion: v1\n    kind: ConfigMap\n    metadata:\n      name: myconfig\n    data:\n      hostname: k8s.example.com\n----\n\n* `file` - File lookup of resources.\nThe value must be a file name which can be found in the Ansible file search path.\nMultiple resource definitions can be included in a single file by including a resource of kind `v1/List` and by including multiple YAML documents in the file.\n+\n----\nfile: configmap.yaml\n----\n\n* `helm_template` - Helm template processing.\nHelm template can be specified with `chart`, `git`, `dir`, `repo`, `values` and `version`.\nIf `chart` is specified then the chart will be looked up in a chart repository, configured with `repo` and `version`.\n`git` may provide a dictionary of parameters to pass to the `git` module and must at least specify `repo`.\nIf `git` is provided then `dir` is the sub-directory within the repository holding the helm chart.\nIf `git` is not provided then the value of `dir` will be searched for within any `helm` subdirectories within the `k8s_config_search_path`.\nValues for the helm chart may be passed as structured data with `values`.\nThe `helm` command must be installed to process the template on the host.\n+\nExample using a chart repository:\n+\n----------------------------------------------\nhelm_template:\n  chart: cert-manager\n  repo: https://charts.jetstack.io\n  values:\n    extraArgs:\n    - --dns01-recursive-nameservers=1.1.1.1:53\n    - --dns01-recursive-nameservers-only\n    installCRDs: true\n  version: v1.8.0\n----------------------------------------------\n+\nExample using git:\n+\n---------------------------------------------------\nhelm_template:\n  git:\n    repo: https://github.com/redhat-cop/anarchy.git\n  dir: helm/\n  values:\n    replicaCount: 2\n---------------------------------------------------\n\n* `openshift_template` - OpenShift template file and parameters.\nThe file can be specified with `file` or `url`.\nA dictionary, `parameters` is used for template parameters.\nA dictionary, `env` can be used similar to the `oc new-app --env` flag to set environment variables in container templates of generated resources.\nThe `oc` command must be installed to process the template on the host.\n+\n----\nopenshift_template:\n  file: openshift-template.yaml\n  parameters:\n    NAME: myconfig\n    HOSTNAME: k8s.example.com\n  env:\n    LOGLEVEL: debug\n----\n\n* `template` - Ansible Jinja2 template with file and variables.\nThe template file must be a file name which can be found in the Ansible template search path.\nVariables provided are in addition to standard Ansible variables such as inventory host variables.\n+\n----\ntemplate:\n  file: configmap.yaml.j2\n  vars:\n    name: myconfig\n    hostname: k8s.example.com\n----\n\n* `info` - Gather info using the Ansible https://docs.ansible.com/ansible/latest/modules/k8s_info_module.html[k8s_info] module.\nMust specify `api_version` and `kind` and may also specify `name` and `namespace`.\n\n* `json_patch` - https://jsonpatch.com/[JSON patch] to apply to resource.\nMust specify `api_version`, `kind`, `name`, and `patch`.\nThe patch must be a valid JSON patch definition with the following adjustments to support idempotent patching of kubernetes resources:\n+\n--\n** `remove` operations are silently ignored when the path is not found in the resource definition.\n** `add` operations are silently ignored when the path is found with the specified value.\n** `add` operations may specify `replace: false` to produce an error if the path is set and is different from value.\n** `test` operations may specify `state` to define how the test value should be evaluated:\n*** `equal` - the path value must equal the specified value, the default behavior.\n*** `unequal` - the path value must not equal the specified value.\n*** `present` - the path must be present with any value.\n*** `absent` - the path must not be found in the resource.\n** `test` operations may specify `operations` as a list of operations to conditionally process if the test condition is true.\nIf a test specifies `operations` then a failed test does not produce an error.\n** List indexes may be given with a simple key query of the form `[?KEY=='VALUE']` to support for various kubernetes use cases where lists have name keys.\nThe list index query resolves to `-` (end of list) if it fails to match when adding a value to a list.\n--\n+\n----\n- name: Set ENV_LEVEL to dev for myapp\n  json_patch:\n    api_version: apps/v1\n    kind: Deployment\n    name: myapp\n    patch:\n    - op: add\n      path: /spec/template/spec/containers/[?name=='myapp']/env/[?name=='ENV_LEVEL']/value\n      value: dev\n----\n+\n----\n- name: Set TEST if ENV_LEVEL is test\n  json_patch:\n    api_version: apps/v1\n    kind: Deployment\n    name: myapp\n    patch:\n    - op: test\n      path: /spec/template/spec/containers/[?name=='myapp']/env/[?name=='ENV_LEVEL']/value\n      value: test\n      operations:\n      - op: add\n        path: /spec/template/spec/containers/[?name=='myapp']/env/[?name=='TEST']/value\n        value: 'true'\n----\n\n=== Multi-cluster Support\n\nThe variable `k8s_clusters` can be set to configure multiple kubernetes clusters with a single role execution.\n`k8s_clusters` is given as a list of dictionaries.\nEach cluster dictionary may specify:\n\n* `api` - API connection and authentication settings, including:\n\n** `ca_cert` - Cluster override for `k8s_api_ca_cert`\n\n** `client_cert` - Cluster override for `k8s_api_client_cert`\n\n** `client_key` - Cluster override for `k8s_api_client_key`\n\n** `token` - Cluster override for `k8s_api_token`\n\n** `url` - Cluster override for `k8s_api_url`\n\n** `validate_certs` - Cluster override for `k8s_api_validate_certs`\n\n* `namespaces` - Cluster override for `k8s_namespaces`\n\n* `resources` - Cluster override for `k8s_resources`\n\n\n== Example Playbooks\n\n=== Configuration through variables:\n\nPlaybook:\n\n----\n- hosts: localhost\n  gather_facts: false\n  roles:\n  - role: k8s_config\n    vars:\n      k8s_resources:\n      - namespace: my-app\n        resources:\n        - name: App Config\n          definition:\n            apiVersion: v1\n            kind: ConfigMap\n            metadata:\n              name: app-config\n            data:\n              envlevel: dev\n----\n\n=== Local Configuration\n\nPlaybook:\n\n----\n- hosts: localhost\n  gather_facts: false\n  roles:\n  - role: k8s_config\n    vars:\n      k8s_config_sources:\n      - name: local\n        base_path \"{{ playbook_dir }}/k8s-config\"\n      k8s_config_environment_level: dev\n----\n\n`k8s-config/main.yaml`\n\n----\nk8s_config_search_path:\n- env/{{ k8s_config_environment_level }}\n- common\n----\n\n`k8s-config/env/dev/vars.yaml`\n\n----\nmyapp_image: example.com/myapp:latest\nmyapp_image_pull_policy: Always\n----\n\n`k8s-config/common/vars.yaml`\n\n----\nmyapp_image: example.com/myapp:v0.1.2\nmyapp_image_pull_policy: IfNotPresent\n\nk8s_resources:\n- namespace: my-app\n  resources:\n  - name: App Config\n    template:\n      file: my-app-config.yaml.j2\n----\n\n`k8s-config/common/templates/app-config.yaml.j2`\n\n----\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app-config\ndata:\n  envlevel: {{ k8s_config_environment_level | to_json }}\n----\n\n=== Multiple Configuration Sources\n\n----\n- hosts: localhost\n  gather_facts: false\n  roles:\n  - role: k8s_config\n    vars:\n      k8s_config_sources:\n      # Load config from k8s-config adjecent to playbook directory\n      - name: local\n        base_path: \"{{ playbook_dir }}/k8s-config\"\n\n      # Load config from private git repository\n      - name: private\n        git:\n          repo: git@github.com:example/k8s-config-private.git\n          key_file: \"{{ deploy_key }}\"\n        when: deploy_key != ''\n\n      # ... and from public git repository\n      - name: example\n        git:\n          repo: https://github.com/example/k8s-config.git\n\n      # Override deploy_key with extra vars to use private repo\n      deploy_key: ''\n----\n\n== License\n\nGNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)\n\n== Author Information\n\nJohnathan Kupferer\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredhat-cop%2Fk8s_config","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fredhat-cop%2Fk8s_config","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredhat-cop%2Fk8s_config/lists"}