TELEICU/Path A: Ansible Pull: Difference between revisions

Content deleted Content added

Inline

Revision as of 08:25, 6 July 2026

guideteleicuCARE 3.0+

Full architecture and workflow for the Ansible Pull migration path.

Architecture

All node configuration is declared in a central git repository. Each hospital PC runs ansible-pull on a cron or systemd timer, checking out the repo and applying the playbook for its host group.

{{#mermaid:flowchart LR
    REPO["Git Repository<br/>(central playbooks)"]
    CP["CP Node(s)<br/>(ansible-pull)"]
    SPOKE["Spoke Agent Node<br/>ansible-pull<br/>→ K3s agent<br/>→ middleware"]
    HUB["Hub Agent Node<br/>ansible-pull<br/>→ K3s agent<br/>→ middleware"]

    REPO -->|"pull (HTTPS / Tailscale)"| CP
    REPO -->|"per-agent pull"| SPOKE
    REPO -->|"per-agent pull"| HUB
}}

What Ansible manages

OS package state (apt pins to prevent version drift)
System configuration (ssh, sysctl, ntp, firewall)
K3s agent install and registration
Cloudflare tunnel service definition and credentials (from vault)
Docker/containerd configuration if needed by workloads
Monitoring agent and log shipper setup
Tailscale install and configuration

What K3s manages

Middleware container deployments
Service discovery and ingress within the cluster
Workload scaling and updates
All workloads are declarative Kubernetes manifests, versioned alongside playbooks

Storage

Longhorn on existing filesystems. No disk repartitioning — Longhorn uses a configured directory or dedicated mount point on the existing ext4/xfs partition.

Rollback

git revert the offending commit in the ansible repo
ansible-pull runs on next timer — nodes converge to the reverted state
For urgent rollbacks, trigger an immediate pull: ansible-pull -U <repo>

Constraints

No filesystem immutability — drift can exist between pull intervals (default: every 15–30 minutes)
Existing OS fragmentation must be handled through conditional Ansible roles
In-place OS upgrade playbook needed to converge Ubuntu versions before or during migration

Repository structure

{{#mermaid:flowchart LR
    subgraph Repo["ansible-teleicu/"]
        ROOT["site.yml<br/>ansible.cfg"]
        INV["inventories/<br/>production/<br/>staging/"]
        ROLES["roles/<br/>common/<br/>tailscale/<br/>k3s-agent/<br/>cloudflared/<br/>monitoring-agent/<br/>middleware/<br/>security-patches/"]
        VARS["group_vars/<br/>all.yml<br/>spokes.yml<br/>hubs.yml"]
        VAULT["vault/"]
    end
}}

@@ Line 12: / Line 12: @@
 All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group.
+<pre>
-syntaxhighlight lang="text"
+{{#mermaid:flowchart LR
-┌──────────────────────┐
+    REPO["Git Repository<br/>(central playbooks)"]
-│   Git repository      │
+    CP["CP Node(s)<br/>(ansible-pull)"]
-│   (central playbooks) │
+    SPOKE["Spoke Agent Node<br/>ansible-pull<br/>→ K3s agent<br/>→ middleware"]
-└──────────┬───────────┘
+    HUB["Hub Agent Node<br/>ansible-pull<br/>→ K3s agent<br/>→ middleware"]
-           │ pull (HTTPS / Tailscale)
-           ▼
+    REPO -->|"pull (HTTPS / Tailscale)"| CP
-┌──────────────────────┐
+    REPO -->|"per-agent pull"| SPOKE
-│   CP node(s)         │
+    REPO -->|"per-agent pull"| HUB
-│   (ansible-pull       │
+}}
-│    also runs here)    │
+</pre>
-└──────────┬───────────┘
-           │
-           ▼ (per-agent pull)
-┌──────────────────────┐     ┌──────────────────────┐
-│   Spoke agent node   │     │   Hub agent node      │
-│   ansible-pull       │     │   ansible-pull        │
-│   → K3s agent        │     │   → K3s agent         │
-│   → middleware       │     │   → middleware         │
-└──────────────────────┘     └──────────────────────┘
-syntaxhighlight
 == What Ansible manages ==
@@ Line 69: / Line 60: @@
 == Repository structure ==
+<pre>
-syntaxhighlight lang="text"
+{{#mermaid:flowchart LR
-ansible-teleicu/
+    subgraph Repo["ansible-teleicu/"]
-├── site.yml              # master playbook
-├── ansible.cfg
+        ROOT["site.yml<br/>ansible.cfg"]
+        INV["inventories/<br/>production/<br/>staging/"]
-├── requirements.yml
+        ROLES["roles/<br/>common/<br/>tailscale/<br/>k3s-agent/<br/>cloudflared/<br/>monitoring-agent/<br/>middleware/<br/>security-patches/"]
-├── inventories/
+        VARS["group_vars/<br/>all.yml<br/>spokes.yml<br/>hubs.yml"]
-│   ├── production/
+        VAULT["vault/"]
-│   │   ├── hosts.ini     # grouped by state, role
+    end
-│   │   └── group_vars/
+}}
-│   └── staging/
+</pre>
-├── roles/
-│   ├── common/            # base hardening
-│   ├── tailscale/         # tailscale install & bringup
-│   ├── k3s-agent/         # join cluster
-│   ├── cloudflared/       # tunnel service
-│   ├── monitoring-agent/  # vmagent + downtime classifier
-│   ├── middleware/        # docker compose or k3s manifest apply
-│   └── security-patches/  # unattended-upgrades / apt pinning
-├── group_vars/
-│   ├── all.yml
-│   ├── spokes.yml
-│   └── hubs.yml
-└── vault/                 # encrypted secrets
-syntaxhighlight
 {{Related}}