feat: Introduce etcd setup and configuration

- Add variables for etcd configuration in ansible/inventory/group_vars/all.yml.
- Include tasks in ansible/k8s_install.yml for bootstrapping the etcd cluster.
- Add tasks in ansible/tasks/bootstrap_etcd.yml to set up etcd binaries, directories, certificates, and services.
- Provide a template for the etcd service file in ansible/templates/db/etcd.service.j2.

ansible/inventory/group_vars/all.yml

@@ -10,9 +10,16 @@ k8s_conf_dir: "{{ k8s_dir }}/conf"
 k8s_cert_dir: "{{ k8s_dir }}/certs"
 k8s_manifest_dir: "{{ k8s_dir }}/manifests"
 k8s_lib_dir: "/var/lib/kubernetes"
+k8s_lib_pki: "/var/lib/kubernetes/pki"
 k8s_log_dir: "/var/log/kubernetes"
 k8s_bin_dir: "/usr/local/bin"
 
+etcd_version: "v3.5.13"
+etcd_google_url: https://storage.googleapis.com/etcd
+etcd_github_url: https://github.com/etcd-io/etcd/releases/download
+etcd_config: "/etc/etcd"
+etcd_libs: "/var/lib/etcd"
+
 #############################################
 # MARK: - Ansible specific variables
 #############################################

ansible/k8s_install.yml

@@ -116,3 +116,13 @@
     - name: Generating the Data Encryption Config and Key
       ansible.builtin.include_tasks: tasks/generate_encryption_config.yml
       tags: encryption
+
+# docs/07-bootstrapping-etcd.md
+- name: Bootstrapping the etcd Cluster
+  hosts: kube_control_plane
+  tags: etcd
+  gather_facts: false
+  tasks:
+    - name: Bootstrapping the etcd Cluster
+      ansible.builtin.include_tasks: tasks/bootstrap_etcd.yml
+      tags: etcd

ansible/tasks/bootstrap_etcd.yml

@@ -0,0 +1,160 @@
+---
+- name: Set ETCD specific facts
+  tags: etcd_facts
+  run_once: true
+  block:
+    - name: Get controlplane1 IP
+      ansible.builtin.shell:
+        cmd: "set -o pipefail; dig +short controlplane01 | tail -n 1"
+      args:
+        executable: /bin/bash
+      register: controlplane1_ip
+
+    - name: Get controlplane2 IP
+      ansible.builtin.shell:
+        cmd: "set -o pipefail; dig +short controlplane02 | tail -n 1"
+      args:
+        executable: /bin/bash
+      register: controlplane2_ip
+
+    - name: Set facts
+      ansible.builtin.set_fact:
+        controlplane1_ip: "{{ controlplane1_ip.stdout }}"
+        controlplane2_ip: "{{ controlplane2_ip.stdout }}"
+
+    - name: Print ETCD facts
+      ansible.builtin.debug:
+        msg: |
+          - CONTROLPLANE1_IP: {{ controlplane1_ip }}
+          - CONTROLPLANE2_IP: {{ controlplane2_ip }}
+
+- name: Install ETCD binaries
+  tags: etcd_install
+  become: true
+  block:
+    - name: Get ARCH variable from /etc/environment
+      ansible.builtin.shell:
+        cmd: "set -o pipefail ; grep -E '^ARCH=' /etc/environment | cut -d'=' -f2"
+      args:
+        executable: /bin/bash
+      register: arch_var
+
+    - name: Download etcd release
+      ansible.builtin.get_url:
+        url: "{{ etcd_google_url }}/{{ etcd_version }}/etcd-{{ etcd_version }}-linux-{{ arch_var.stdout }}.tar.gz"
+        dest: "/tmp/etcd-{{ etcd_version }}-linux-{{ arch_var.stdout }}.tar.gz"
+        mode: '0644'
+
+    - name: Make etcd download directory
+      ansible.builtin.file:
+        path: "/tmp/etcd-download-test"
+        state: directory
+        mode: '0755'
+
+    - name: Unarchive a file with extra options
+      ansible.builtin.unarchive:
+        remote_src: true
+        src: "/tmp/etcd-{{ etcd_version }}-linux-{{ arch_var.stdout }}.tar.gz"
+        dest: "/tmp/etcd-download-test"
+        extra_opts:
+          - --strip-components=1
+          - --show-stored-names
+
+    - name: Delete etcd tarball
+      ansible.builtin.file:
+        path: "/tmp/etcd-{{ etcd_version }}-linux-{{ arch_var.stdout }}.tar.gz"
+        state: absent
+
+    - name: Move etcd binaries to /usr/local/bin
+      ansible.builtin.copy:
+        remote_src: true
+        src: "/tmp/etcd-download-test/{{ item }}"
+        dest: "/usr/local/bin/{{ item }}"
+        mode: '0755'
+      with_items:
+        - etcd
+        - etcdctl
+        - etcdutl
+
+    - name: Get etcd version
+      ansible.builtin.shell:
+        cmd: "etcd --version"
+      args:
+        executable: /bin/bash
+      register: etcd_version
+      changed_when: false
+
+    - name: Print the etcd version
+      ansible.builtin.debug:
+        msg: "ETCD_VERSION: {{ etcd_version.stdout }}"
+
+- name: Configure the etcd Server
+  become: true
+  tags: etcd_config
+  block:
+    - name: Create the ETCD directories
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0755'
+      with_items:
+        - "{{ k8s_lib_pki }}"
+        - "{{ etcd_config }}"
+        - "{{ etcd_libs }}"
+
+    - name: Copy certificates to the ETCD directories
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: "{{ etcd_config }}"
+        mode: '0600'
+      with_items:
+        - "{{ local_certs_path }}/etcd-server.key"
+        - "{{ local_certs_path }}/etcd-server.crt"
+
+    - name: Copy CA certificate to k8s lib pki
+      ansible.builtin.copy:
+        src: "{{ local_certs_path }}/ca.crt"
+        dest: "{{ k8s_lib_pki }}"
+        mode: '0600'
+
+    - name: Make symlink for CA to etcd config directory
+      ansible.builtin.file:
+        src: "{{ k8s_lib_pki }}/ca.crt"
+        dest: "{{ etcd_config }}/ca.crt"
+        state: link
+
+    - name: Create the etcd service file
+      ansible.builtin.template:
+        src: "db/etcd.service.j2"
+        dest: "/etc/systemd/system/etcd.service"
+        mode: '0644'
+
+    - name: Reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Start etcd service
+      ansible.builtin.systemd:
+        name: etcd
+        state: started
+        enabled: true
+
+- name: Verify list of etcd cluster members
+  become: true
+  tags: etcd_verify
+  ansible.builtin.shell:
+    cmd: |
+      etcdctl member list \
+      --endpoints=https://127.0.0.1:2379 \
+      --cacert={{ k8s_lib_pki }}/ca.crt \
+      --cert={{ etcd_config }}/etcd-server.crt \
+      --key={{ etcd_config }}/etcd-server.key
+  args:
+    executable: /bin/bash
+  environment:
+    ETCDCTL_API: "3"
+  register: etcd_members
+
+- name: Print etcd cluster members
+  ansible.builtin.debug:
+    msg: "{{ etcd_members.stdout }}"

ansible/templates/db/etcd.service.j2

@@ -0,0 +1,15 @@
+# FILE MANAGED BY ANSIBLE: DO NOT EDIT!
+# {{ ansible_managed }}
+{% set etcd_hostname = inventory_hostname %}
+{% set primary_ip = ansible_all_ipv4_addresses[1] %}
+[Unit]
+Description=etcd
+Documentation=https://github.com/coreos
+
+[Service]
+ExecStart=/usr/local/bin/etcd --name {{ etcd_hostname }} --cert-file=/etc/etcd/etcd-server.crt --key-file=/etc/etcd/etcd-server.key --peer-cert-file=/etc/etcd/etcd-server.crt --peer-key-file=/etc/etcd/etcd-server.key --trusted-ca-file=/etc/etcd/ca.crt --peer-trusted-ca-file=/etc/etcd/ca.crt --peer-client-cert-auth --client-cert-auth --initial-advertise-peer-urls https://{{ primary_ip }}:2380 --listen-peer-urls https://{{ primary_ip }}:2380 --listen-client-urls https://{{ primary_ip }}:2379,https://127.0.0.1:2379 --advertise-client-urls https://{{ primary_ip }}:2379 --initial-cluster-token etcd-cluster-0 --initial-cluster controlplane01=https://{{ controlplane1_ip }}:2380,controlplane02=https://{{ controlplane2_ip }}:2380 --initial-cluster-state new --data-dir=/var/lib/etcd
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target