Ansible and Kubernetes

# CHAPTER 12

Ansible and Kubernetes #

1. Introduction #

2. Learning Objectives #

• Understand the relationship between Ansible automation and Kubernetes orchestration.

• Install and configure the kubernetes.core Ansible collection.

• Deploy native Kubernetes resources (Namespaces, Deployments, Services) using Ansible modules.

• Utilize Jinja2 templates to dynamically generate K8s manifests.

• Understand the authentication mechanisms required for Ansible to speak to the K8s API.

3. Beginner-Friendly Explanation #

• Raw Kubernetes (kubectl): You (the composer) hand the conductor a stack of 50 handwritten sheet music pages (YAML files). If you want to change the song from a major to a minor key, you have to manually erase and rewrite all 50 pages.

• Ansible + Kubernetes: You write one smart sheet of music with a variable: {{ key = "minor" }}. You hand it to Ansible. Ansible instantly generates all 50 pages perfectly in the minor key and hands them to the conductor.

Ansible doesn't replace Kubernetes; it makes commanding Kubernetes infinitely faster and dynamic.

4. Setting up the K8s Environment #

*On your Control Node:*

pip install kubernetes
ansible-galaxy collection install kubernetes.core

Ansible authenticates to your K8s cluster exactly the same way you do: it looks for the ~/.kube/config file on the Control Node.

5. Deploying Kubernetes Resources #

---
- name: Deploy Nginx to Kubernetes
  hosts: localhost # We run this on the Control Node, not a remote server!
  
  tasks:
    # 1. Create a logical workspace (Namespace)
    - name: Ensure namespace exists
      kubernetes.core.k8s:
        name: frontend-app
        api_version: v1
        kind: Namespace
        state: present

    # 2. Deploy the containers
    - name: Deploy Nginx Pods
      kubernetes.core.k8s:
        state: present
        definition:
          # This is raw K8s YAML embedded inside Ansible!
          apiVersion: apps/v1
          kind: Deployment
          metadata:
            name: nginx-deployment
            namespace: frontend-app
          spec:
            replicas: 3
            selector:
              matchLabels:
                app: nginx
            template:
              metadata:
                labels:
                  app: nginx
              spec:
                containers:
                - name: nginx
                  image: nginx:1.21.6
                  ports:
                  - containerPort: 80

6. Mini Project: Dynamic K8s Deployment with Templates #

Step-by-Step Architecture Concept: 1. The Template (templates/deployment.yml.j2)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ app_name }}
spec:
  replicas: {{ container_count }} # Dynamic scaling!
  template:
    spec:
      containers:
      - name: {{ app_name }}
        image: "{{ image_name }}:{{ image_version }}"

2. The Playbook (deploy.yml)

---
- name: Dynamic Kubernetes Orchestration
  hosts: localhost
  vars:
    app_name: "payment-service"
    container_count: 5
    image_name: "mycompany/payment"
    image_version: "v2.0"

  tasks:
    - name: Apply dynamic K8s template
      kubernetes.core.k8s:
        state: present
        # Ansible compiles the Jinja2 template into raw K8s YAML and deploys it!
        template: 'templates/deployment.yml.j2'

*If you need to update the app to v2.1 and scale up to 10 containers, you just change the variables in the playbook. You don't touch the K8s manifest!*

7. Real-World Scenarios #

8. Best Practices #

• hosts: localhost: Notice in the examples we used hosts: localhost. When deploying to Kubernetes, Ansible does not SSH into the worker nodes. Ansible runs the python scripts locally on the Control Node, which makes HTTP API calls directly to the Kubernetes API server.

9. Security Recommendations #

• Kubeconfig Security: Since Ansible relies on the ~/.kube/config file to authenticate, whoever has access to the Ansible Control Node has administrator access to the entire Kubernetes cluster. In a CI/CD pipeline, you must inject the Kubeconfig file dynamically as an encrypted secret, use it for the deployment, and immediately delete it.

10. Troubleshooting Tips #

• Python Module Missing: The most common error is Failed to import the required Python library (openshift or kubernetes). Ensure you ran pip install kubernetes on the machine executing the playbook. If using a virtual environment, ensure Ansible is using the correct python interpreter.

11. Exercises #

1. 1. Explain the architectural difference in how Ansible communicates with a standard Linux server versus how it communicates with a Kubernetes Cluster.

1. 2. What is the operational advantage of using the template parameter in the k8s module over embedding the resource definition directly in the playbook?

12. FAQs #

13. Interview Questions #

• Q: Describe the integration architecture between Ansible and Kubernetes. How does leveraging Jinja2 templating within Ansible playbooks resolve the rigidity inherent in native Kubernetes manifest files?

• Q: An engineering team is manually running kubectl apply across multiple environments. Propose an automated Ansible workflow to standardize these deployments, specifically addressing parameterization and credential management.

14. Summary #

15. Next Chapter Recommendation #