Revert roles to root-only mode

docs/gpu-k8s-role.md

@@ -30,14 +30,13 @@ sealos run \
   --env '{}' \
   --cmd "kubeadm init --skip-phases=addon/kube-proxy"
 ```
-If deploying with a non-root user the command also requires `--user` and
-`--pk` options pointing to the user's SSH key.
+
 
 After the cluster is running the role installs the NVIDIA device plugin and runs a test pod to ensure `nvidia-smi` works inside the cluster.
 
 ## Usage
 
-Add the role to your playbook along with the `ssh-trust` role which configures passwordless access from the ops host to the cluster nodes:
+Add the role to your playbook along with the `ssh-trust` role which configures passwordless access from the ops host to the cluster nodes. The `gpu-k8s` role automatically pulls in the `common` role so you do not need to list it separately:
 
 ```yaml
 - hosts: all
@@ -46,23 +45,7 @@ Add the role to your playbook along with the `ssh-trust` role which configures p
     - gpu-k8s
 ```
 
-By default the SSH key is created for the same user Ansible connects with. You
-can override this by setting `ssh_user`. When `ansible_user` is defined it will
-be used automatically, otherwise `root` is assumed. The role also allows you to
-specify the private key path via `ssh_private_key`:
 
-```yaml
-- hosts: all
-  vars:
-    ssh_user: ubuntu
-    ssh_private_key: /home/ubuntu/.ssh/myuser_id_rsa
-  roles:
-    - ssh-trust
-    - gpu-k8s
-```
-
-The specified user must be able to log in without a password and have sudo
-access on the target hosts.
 
 
 Example playbook snippet defining the IP lists:

playbooks/demo_gpu_k8s.yml

@@ -12,4 +12,3 @@
   roles:
     - roles/vhosts/ssh-trust/
     - roles/vhosts/gpu-k8s/
-    - roles/vhosts/common/

playbooks/roles/vhosts/common/files/install-packages.sh

@@ -4,4 +4,4 @@ export DEBIAN_FRONTEND=noninteractive
 curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor > /usr/share/keyrings/hashicorp-archive-keyring.gpg
 sudo echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" > /etc/apt/sources.list.d/hashicorp.list
 sudo apt-get update
-sudo apt-get install -y vault auditd
+sudo apt-get install -y vault auditd uidmap fuse-overlayfs

playbooks/roles/vhosts/gpu-k8s/defaults/main.yml

@@ -9,5 +9,3 @@ master_ips: []  # List of up to three master node IPs
 node_ips: []    # List of worker node IPs
 sealos_cmd_env: '{}'
 kubeadm_init_cmd: "kubeadm init --skip-phases=addon/kube-proxy"
-ssh_user: "{{ ansible_user | default('root') }}"
-ssh_private_key: "{{ ansible_ssh_private_key_file | default('~/.ssh/id_rsa') }}"

playbooks/roles/vhosts/gpu-k8s/meta/main.yml

@@ -0,0 +1,2 @@
+dependencies:
+  - role: common

playbooks/roles/vhosts/gpu-k8s/tasks/install_cluster.yml

@@ -78,8 +78,8 @@
 - name: Verify passwordless SSH access to all cluster nodes
   shell: >-
     ssh -o BatchMode=yes -o StrictHostKeyChecking=no \
-    -i {{ ssh_private_key }} \
-    {{ ssh_user | default(ansible_ssh_user | default(ansible_user, true) | default('root')) }}@{{ item }} hostname
+    -i {{ ansible_ssh_private_key_file | default('~/.ssh/id_rsa') }} \
+    root@{{ item }} hostname
   loop: "{{ master_ips + node_ips }}"
   delegate_to: "{{ ops_host | default(masters | default(master_ips) | first) }}"
   become: false
@@ -95,8 +95,6 @@
       {{ labring_registry.stdout }}/helm:{{ helm_version }} \
       --masters {{ master_ips | join(',') }} \
       --nodes {{ node_ips | join(',') }} \
-      --user {{ ssh_user }} \
-      --pk {{ ssh_private_key }} \
       --env '{{ sealos_cmd_env }}' \
       --cmd "{{ kubeadm_init_cmd }}"
   args:

playbooks/roles/vhosts/ssh-trust/defaults/main.yml

@@ -1,2 +1 @@
-# Default user for generating and installing SSH key
-ssh_user: "{{ ansible_user | default('root') }}"
+# Default variables for ssh-trust role

playbooks/roles/vhosts/ssh-trust/tasks/main.yml

@@ -6,7 +6,7 @@
   delegate_to: "{{ ops_host }}"
   run_once: true
   become: true
-  become_user: "{{ ssh_user }}"
+  become_user: root
 
 - name: Fetch ops host public key
   slurp:
@@ -15,9 +15,9 @@
   delegate_to: "{{ ops_host }}"
   run_once: true
   become: true
-  become_user: "{{ ssh_user }}"
+  become_user: root
 
 - name: Authorize ops host key on cluster hosts
   ansible.builtin.authorized_key:
-    user: "{{ ssh_user }}"
+    user: root
     key: "{{ ops_pub_key.content | b64decode }}"