feat(ansible): journald永続化をcontrol-planeに追加 [BOXP-127]

.github/workflows/test-ansible.yml

@@ -125,7 +125,7 @@ jobs:
           if [ -d "$role_path/molecule" ]; then
             echo "Testing role: $role_path"
             cd "$role_path"
-            molecule test
+            molecule test --all
           else
             echo "No molecule tests found for role: $role_path, skipping"
           fi

ansible/playbooks/control-plane.yml

@@ -106,3 +106,4 @@
         kubelet_cluster_dns: "{{ cluster_dns }}"
         kubelet_cluster_domain: "{{ cluster_domain }}"
         kubelet_node_ip: "{{ node_ip }}"
+        journald_persistent_storage: true

ansible/roles/kubernetes_components/defaults/main.yml

@@ -69,3 +69,12 @@ sysctl_config:
 # Increased from default 100m CPU / 100Mi memory to accommodate ARM processor characteristics
 etcd_resource_requests_cpu: "200m"
 etcd_resource_requests_memory: "200Mi"
+
+# journald persistent storage configuration
+# Disabled by default; enable explicitly for control-plane nodes where persistent logs are needed.
+# See playbooks/control-plane.yml for the enabling override.
+journald_persistent_storage: false
+# Set to true only when removing existing persistent journal history is intended.
+journald_purge_persistent_logs: false
+journald_system_max_use: "200M"
+journald_max_retention_sec: "1month"

ansible/roles/kubernetes_components/handlers/main.yml

@@ -43,3 +43,13 @@
     - ansible_virtualization_type != "docker"
     - chroot_build is not defined or not chroot_build
   listen: "Restart kubelet"
+
+- name: Restart systemd-journald
+  ansible.builtin.systemd:
+    name: systemd-journald
+    state: restarted
+  become: true
+  when:
+    - ansible_virtualization_type != "docker"
+    - chroot_build is not defined or not chroot_build
+  listen: "Restart systemd-journald"

ansible/roles/kubernetes_components/molecule/default/converge.yml

@@ -7,4 +7,5 @@
   vars:
     # Test-specific overrides for container environment
     kubernetes_disable_swap: false  # Skip swap operations in container
-    kubernetes_enable_modules: false  # Skip module loading in container
+    kubernetes_enable_modules: false  # Skip module loading in container
+    journald_persistent_storage: true  # Validate the persistent-storage code path

ansible/roles/kubernetes_components/molecule/default/verify.yml

@@ -2,6 +2,8 @@
 - name: Verify
   hosts: all
   gather_facts: true
+  vars:
+    journald_persistent_storage: true
   tasks:
     - name: Check if CRI-O is installed
       ansible.builtin.package_facts:
@@ -144,3 +146,50 @@
         that:
           - "'1.32' in kubectl_version.stdout"
         fail_msg: "Kubectl version is not as expected"
+
+    - name: Check if persistent journal directory exists
+      ansible.builtin.stat:
+        path: /var/log/journal
+      register: journal_dir
+
+    - name: Assert persistent journal directory exists
+      ansible.builtin.assert:
+        that:
+          - journal_dir.stat.exists
+          - journal_dir.stat.isdir
+        fail_msg: "/var/log/journal directory does not exist — journald persistent storage not configured"
+      when: journald_persistent_storage | bool
+
+    - name: Check if journald drop-in config exists
+      ansible.builtin.stat:
+        path: /etc/systemd/journald.conf.d/10-persistent-storage.conf
+      register: journald_dropin
+
+    - name: Assert journald drop-in config is absent when persistent storage is disabled
+      ansible.builtin.assert:
+        that:
+          - not journald_dropin.stat.exists
+        fail_msg: "journald persistent-storage drop-in must be absent when persistent storage is disabled"
+      when: not (journald_persistent_storage | bool)
+
+    - name: Assert journald drop-in config exists when persistent storage is enabled
+      ansible.builtin.assert:
+        that:
+          - journald_dropin.stat.exists
+        fail_msg: "journald drop-in /etc/systemd/journald.conf.d/10-persistent-storage.conf does not exist"
+      when: journald_persistent_storage | bool
+
+    - name: Read journald drop-in config
+      ansible.builtin.slurp:
+        path: /etc/systemd/journald.conf.d/10-persistent-storage.conf
+      register: journald_dropin_content
+      when: journald_persistent_storage | bool
+
+    - name: Assert journald is configured for persistent storage
+      ansible.builtin.assert:
+        that:
+          - "'Storage=persistent' in (journald_dropin_content.content | b64decode)"
+          - "'SystemMaxUse=200M' in (journald_dropin_content.content | b64decode)"
+          - "'MaxRetentionSec=1month' in (journald_dropin_content.content | b64decode)"
+        fail_msg: "journald drop-in is missing Storage=persistent, SystemMaxUse=200M, or MaxRetentionSec=1month"
+      when: journald_persistent_storage | bool

ansible/roles/kubernetes_components/molecule/journald-disabled/converge.yml

@@ -0,0 +1,10 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+  roles:
+    - role: ../../../../kubernetes_components
+  vars:
+    kubernetes_disable_swap: false
+    kubernetes_enable_modules: false
+    journald_persistent_storage: false  # Validate the disabled (volatile) code path

ansible/roles/kubernetes_components/molecule/journald-disabled/molecule.yml

@@ -0,0 +1,29 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-ubuntu2404-ansible:latest"
+    platform: "${MOLECULE_DOCKER_PLATFORM:-linux/amd64}"
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    command: /lib/systemd/systemd
+    env:
+      DEBIAN_FRONTEND: noninteractive
+    groups:
+      - orange_pi_zero3
+provisioner:
+  name: ansible
+  inventory:
+    host_vars:
+      instance:
+        ansible_python_interpreter: /usr/bin/python3
+        hardware_type: orange_pi_zero3
+        architecture: arm64
+verifier:
+  name: ansible

ansible/roles/kubernetes_components/molecule/journald-disabled/prepare.yml

@@ -0,0 +1,97 @@
+---
+- name: Prepare Orange Pi Zero 3 simulation environment
+  hosts: all
+  gather_facts: true
+  tasks:
+    - name: Update package cache
+      ansible.builtin.package:
+        update_cache: true
+      become: true
+
+    - name: Install required packages for Orange Pi Zero 3 simulation
+      ansible.builtin.package:
+        name:
+          - systemd
+          - dbus
+          - init
+          - iproute2
+          - kmod
+          - procps
+          - curl
+          - gnupg
+          - ca-certificates
+        state: present
+      become: true
+
+    - name: Create kernel modules directory
+      ansible.builtin.file:
+        path: /lib/modules
+        state: directory
+        mode: '0755'
+      become: true
+
+    - name: Ensure systemd is running
+      ansible.builtin.systemd:
+        name: systemd-logind
+        state: started
+      become: true
+      failed_when: false
+
+    - name: Create SSH host keys
+      ansible.builtin.command: ssh-keygen -A
+      become: true
+      changed_when: false
+      failed_when: false
+
+    - name: Create mock kernel modules for testing
+      ansible.builtin.shell: |
+        set -o pipefail
+        mkdir -p /lib/modules/$(uname -r)
+        touch /lib/modules/$(uname -r)/modules.dep
+        touch /lib/modules/$(uname -r)/modules.symbols
+      become: true
+      changed_when: false
+      failed_when: false
+
+    - name: Mock modprobe for container environment
+      ansible.builtin.copy:
+        dest: /usr/local/bin/modprobe
+        content: |
+          #!/bin/bash
+          # Mock modprobe for container testing
+          echo "Mock modprobe: $*"
+          exit 0
+        mode: '0755'
+      become: true
+
+    - name: Ensure journald drop-in directory exists
+      ansible.builtin.file:
+        path: /etc/systemd/journald.conf.d
+        state: directory
+        mode: '0755'
+      become: true
+
+    - name: Pre-create role-managed journald drop-in (simulates prior persistent-enable run)
+      ansible.builtin.copy:
+        dest: /etc/systemd/journald.conf.d/10-persistent-storage.conf
+        mode: '0644'
+        content: |
+          [Journal]
+          Storage=persistent
+          SystemMaxUse=200M
+          MaxRetentionSec=1month
+      become: true
+
+    - name: Pre-create /var/log/journal to simulate existing persistent journal
+      ansible.builtin.file:
+        path: /var/log/journal
+        state: directory
+        mode: '2755'
+      become: true
+
+    - name: Create a sentinel file inside /var/log/journal to confirm non-destructive behavior
+      ansible.builtin.copy:
+        dest: /var/log/journal/.keep
+        content: "pre-existing log marker"
+        mode: '0644'
+      become: true

ansible/roles/kubernetes_components/molecule/journald-disabled/verify.yml

@@ -0,0 +1,44 @@
+---
+- name: Verify journald disabled path
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Stat journald drop-in file
+      ansible.builtin.stat:
+        path: /etc/systemd/journald.conf.d/10-persistent-storage.conf
+      register: journald_dropin_stat
+
+    - name: Assert drop-in is absent when persistent storage is disabled
+      ansible.builtin.assert:
+        that:
+          - not journald_dropin_stat.stat.exists
+        fail_msg: >-
+          journald drop-in must be absent when journald_persistent_storage is false,
+          but the file exists at /etc/systemd/journald.conf.d/10-persistent-storage.conf
+
+    - name: Stat /var/log/journal directory
+      ansible.builtin.stat:
+        path: /var/log/journal
+      register: journal_dir_stat
+
+    - name: Assert /var/log/journal is preserved (non-destructive when disabled)
+      ansible.builtin.assert:
+        that:
+          - journal_dir_stat.stat.exists
+          - journal_dir_stat.stat.isdir
+        fail_msg: >-
+          /var/log/journal must be preserved when journald_persistent_storage is false —
+          the role must not destroy existing log data
+
+    - name: Stat sentinel file inside /var/log/journal
+      ansible.builtin.stat:
+        path: /var/log/journal/.keep
+      register: journal_keep_stat
+
+    - name: Assert sentinel file is preserved (pre-existing logs not deleted)
+      ansible.builtin.assert:
+        that:
+          - journal_keep_stat.stat.exists
+        fail_msg: >-
+          Pre-existing /var/log/journal/.keep was deleted — the role must not purge existing logs
+          unless journald_purge_persistent_logs is explicitly set to true

ansible/roles/kubernetes_components/molecule/journald-purge/converge.yml

@@ -0,0 +1,11 @@
+---
+- name: Converge
+  hosts: all
+  become: true
+  roles:
+    - role: ../../../../kubernetes_components
+  vars:
+    kubernetes_disable_swap: false
+    kubernetes_enable_modules: false
+    journald_persistent_storage: false
+    journald_purge_persistent_logs: true  # Validate the explicit purge opt-in path

ansible/roles/kubernetes_components/molecule/journald-purge/molecule.yml

@@ -0,0 +1,29 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+platforms:
+  - name: instance
+    image: "geerlingguy/docker-ubuntu2404-ansible:latest"
+    platform: "${MOLECULE_DOCKER_PLATFORM:-linux/amd64}"
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    command: /lib/systemd/systemd
+    env:
+      DEBIAN_FRONTEND: noninteractive
+    groups:
+      - orange_pi_zero3
+provisioner:
+  name: ansible
+  inventory:
+    host_vars:
+      instance:
+        ansible_python_interpreter: /usr/bin/python3
+        hardware_type: orange_pi_zero3
+        architecture: arm64
+verifier:
+  name: ansible