TELEICU/Path A: Ansible Pull: Difference between revisions
From OHC Network Wiki
More languages
More actions
Content deleted Content added
Replace ASCII art with Mermaid diagrams (via update-page on MediaWiki MCP Server) |
Fix Mermaid diagrams: remove <pre> wrapping so parser functions execute (via update-page on MediaWiki MCP Server) |
||
| (One intermediate revision by the same user not shown) | |||
| Line 12: | Line 12: | ||
All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group. |
All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group. |
||
<pre> |
|||
{{#mermaid:flowchart LR |
{{#mermaid:flowchart LR |
||
REPO["Git Repository<br/>(central playbooks)"] |
REPO["Git Repository<br/>(central playbooks)"] |
||
| Line 23: | Line 22: | ||
REPO -->|"per-agent pull"| HUB |
REPO -->|"per-agent pull"| HUB |
||
}} |
}} |
||
</pre> |
|||
== What Ansible manages == |
== What Ansible manages == |
||
| Line 60: | Line 58: | ||
== Repository structure == |
== Repository structure == |
||
<pre> |
|||
{{#mermaid:flowchart LR |
{{#mermaid:flowchart LR |
||
subgraph Repo["ansible-teleicu/"] |
subgraph Repo["ansible-teleicu/"] |
||
| Line 70: | Line 67: | ||
end |
end |
||
}} |
}} |
||
</pre> |
|||
{{Navbox TELEICU}} |
|||
{{Related}} |
{{Related}} |
||
Latest revision as of 08:48, 6 July 2026
Full architecture and workflow for the Ansible Pull migration path.
Architecture
All node configuration is declared in a central git repository. Each hospital PC runs ansible-pull on a cron or systemd timer, checking out the repo and applying the playbook for its host group.
What Ansible manages
- OS package state (apt pins to prevent version drift)
- System configuration (ssh, sysctl, ntp, firewall)
- K3s agent install and registration
- Cloudflare tunnel service definition and credentials (from vault)
- Docker/containerd configuration if needed by workloads
- Monitoring agent and log shipper setup
- Tailscale install and configuration
What K3s manages
- Middleware container deployments
- Service discovery and ingress within the cluster
- Workload scaling and updates
- All workloads are declarative Kubernetes manifests, versioned alongside playbooks
Storage
Longhorn on existing filesystems. No disk repartitioning — Longhorn uses a configured directory or dedicated mount point on the existing ext4/xfs partition.
Rollback
git revertthe offending commit in the ansible repoansible-pullruns on next timer — nodes converge to the reverted state- For urgent rollbacks, trigger an immediate pull:
ansible-pull -U <repo>
Constraints
- No filesystem immutability — drift can exist between pull intervals (default: every 15–30 minutes)
- Existing OS fragmentation must be handled through conditional Ansible roles
- In-place OS upgrade playbook needed to converge Ubuntu versions before or during migration