sync current state
This commit is contained in:
@@ -1,59 +0,0 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# FILE: roles/control-plane/tasks/main.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: Check if cluster is already initialized
|
||||
ansible.builtin.stat:
|
||||
path: /etc/kubernetes/admin.conf
|
||||
register: kube_init_stat
|
||||
|
||||
- name: Initialize the Kubernetes cluster
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: >
|
||||
kubeadm init
|
||||
--pod-network-cidr=10.244.0.0/16
|
||||
--control-plane-endpoint={{ inventory_hostname }}
|
||||
register: kubeadm_init
|
||||
|
||||
- name: Create .kube directory for the user
|
||||
become: false
|
||||
ansible.builtin.file:
|
||||
path: "{{ ansible_env.HOME }}/.kube"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
|
||||
- name: Copy admin.conf to user's .kube directory on controller
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.fetch:
|
||||
src: /etc/kubernetes/admin.conf
|
||||
dest: "{{ ansible_env.HOME }}/.kube/config"
|
||||
flat: true
|
||||
|
||||
- name: Install Calico CNI
|
||||
become: false
|
||||
ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/calico.yaml
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: not kube_init_stat.stat.exists
|
||||
|
||||
- name: Generate join command for control plane nodes
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: kubeadm token create --print-join-command
|
||||
register: control_plane_join_command_raw
|
||||
|
||||
- name: Generate certificate key for control plane join
|
||||
when: not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: kubeadm init phase upload-certs --upload-certs
|
||||
register: control_plane_cert_key
|
||||
|
||||
- name: Store control plane join command
|
||||
ansible.builtin.set_fact:
|
||||
control_plane_join_command: "{{ control_plane_join_command_raw.stdout }} --control-plane --certificate-key {{ control_plane_cert_key.stdout_lines[-1] }}"
|
||||
when: not kube_init_stat.stat.exists
|
||||
|
||||
- name: Join other control plane nodes to the cluster
|
||||
when:
|
||||
- inventory_hostname != groups['fastpass_control_plane'][0]
|
||||
- not kube_init_stat.stat.exists
|
||||
ansible.builtin.command: "{{ hostvars[groups['fastpass_control_plane'][0]].control_plane_join_command }}"
|
||||
@@ -1,35 +0,0 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# FILE: roles/fastpass_workers/tasks/main.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: Generate join command for worker nodes
|
||||
ansible.builtin.command: kubeadm token create --print-join-command
|
||||
delegate_to: "{{ groups['fastpass_control_plane'][0] }}"
|
||||
run_once: true
|
||||
register: worker_join_command
|
||||
|
||||
- name: Join worker nodes to the cluster
|
||||
ansible.builtin.command: "{{ hostvars[groups['fastpass_control_plane'][0]].worker_join_command.stdout }}"
|
||||
|
||||
- name: Label and Taint on-stage worker nodes
|
||||
become: false
|
||||
ansible.builtin.command: "kubectl {{ item }}"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
loop:
|
||||
- label node seven-dwarfs-mine-train zone=on-stage --overwrite
|
||||
- taint node seven-dwarfs-mine-train dedicated=external:NoSchedule --overwrite
|
||||
when: "'seven-dwarfs-mine-train' in inventory_hostname"
|
||||
|
||||
- name: Label backstage worker node haunted-mansion
|
||||
become: false
|
||||
ansible.builtin.command: "kubectl label node haunted-mansion zone=backstage --overwrite"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: "'haunted-mansion' in inventory_hostname"
|
||||
|
||||
- name: Label backstage worker node peter-pans-flight
|
||||
become: false
|
||||
ansible.builtin.command: "kubectl label node peter-pans-flight zone=backstage --overwrite"
|
||||
delegate_to: localhost
|
||||
run_once: true
|
||||
when: "'peter-pans-flight' in inventory_hostname"
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
# Kubernetes Prerequisites Role Defaults
|
||||
|
||||
# Kubernetes version to install (should be overridden in group_vars)
|
||||
kubernetes_version: "v1.33"
|
||||
|
||||
# Container runtime (containerd is default)
|
||||
container_runtime: "containerd"
|
||||
|
||||
# CNI plugin to install
|
||||
cni_plugin: "calico"
|
||||
|
||||
# Firewall configuration
|
||||
configure_firewall: true
|
||||
|
||||
# Time synchronization
|
||||
configure_ntp: true
|
||||
|
||||
# SELinux configuration
|
||||
selinux_state: "permissive"
|
||||
|
||||
# Swap configuration
|
||||
disable_swap: true
|
||||
|
||||
# Kernel modules to load
|
||||
required_kernel_modules:
|
||||
- overlay
|
||||
- br_netfilter
|
||||
|
||||
# Sysctl parameters for Kubernetes
|
||||
k8s_sysctl_params:
|
||||
net.bridge.bridge-nf-call-iptables: 1
|
||||
net.bridge.bridge-nf-call-ip6tables: 1
|
||||
net.ipv4.ip_forward: 1
|
||||
|
||||
# Kubernetes firewall ports
|
||||
k8s_firewall_ports:
|
||||
- { protocol: "tcp", port: "6443" } # API server
|
||||
- { protocol: "tcp", port: "2379" } # etcd client
|
||||
- { protocol: "tcp", port: "2380" } # etcd peer
|
||||
- { protocol: "tcp", port: "10250" } # kubelet
|
||||
- { protocol: "tcp", port: "10251" } # kube-scheduler
|
||||
- { protocol: "tcp", port: "10252" } # kube-controller-manager
|
||||
- { protocol: "tcp", port: "10255" } # kubelet read-only
|
||||
- { protocol: "tcp", port: "30000-32767" } # NodePort services
|
||||
- { protocol: "udp", port: "4789" } # VXLAN (Flannel)
|
||||
- { protocol: "tcp", port: "179" } # BGP (Calico)
|
||||
210
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
Normal file
210
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
Normal file
@@ -0,0 +1,210 @@
|
||||
---
|
||||
- name: Set Kubernetes-compatible hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
|
||||
|
||||
- name: Remove zram-generator-defaults
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/zram-generator.conf
|
||||
state: absent
|
||||
|
||||
- name: Disable swap
|
||||
ansible.builtin.shell: swapoff -a
|
||||
when: disable_swap | default(true)
|
||||
|
||||
- name: Persist swap off by commenting out swap in fstab
|
||||
ansible.builtin.replace:
|
||||
path: /etc/fstab
|
||||
regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
|
||||
replace: '# \1'
|
||||
when: disable_swap | default(true)
|
||||
|
||||
- name: Load required kernel modules
|
||||
ansible.builtin.modprobe:
|
||||
name: "{{ item }}"
|
||||
loop: "{{ required_kernel_modules }}"
|
||||
|
||||
- name: Persist kernel modules on boot
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/modules-load.d/k8s.conf
|
||||
content: "{{ required_kernel_modules | join('\n') }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Configure required sysctl params for Kubernetes
|
||||
ansible.builtin.template:
|
||||
dest: /etc/sysctl.d/k8s.conf
|
||||
src: k8s-sysctl.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Apply sysctl params without reboot
|
||||
ansible.builtin.shell: sysctl --system
|
||||
|
||||
- name: Install python3-libselinux for managing selinux
|
||||
ansible.builtin.dnf:
|
||||
name: python3-libselinux
|
||||
state: present
|
||||
|
||||
- name: Set SELinux to permissive mode
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: "{{ selinux_state }}"
|
||||
|
||||
- name: Install and configure chrony for time synchronization
|
||||
ansible.builtin.dnf:
|
||||
name: chrony
|
||||
state: present
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Start and enable chronyd
|
||||
ansible.builtin.systemd:
|
||||
name: chronyd
|
||||
state: started
|
||||
enabled: true
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Force time synchronization
|
||||
ansible.builtin.shell: chronyc makestep
|
||||
ignore_errors: true
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Install firewalld
|
||||
ansible.builtin.dnf:
|
||||
name: firewalld
|
||||
state: present
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Start and enable firewalld
|
||||
ansible.builtin.systemd:
|
||||
name: firewalld
|
||||
state: started
|
||||
enabled: true
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Create Kubernetes service definition
|
||||
ansible.builtin.template:
|
||||
dest: /etc/firewalld/services/kubernetes.xml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
src: kubernetes-firewall-service.xml.j2
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Reload firewalld to load new service
|
||||
ansible.builtin.shell: firewall-cmd --reload
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Add Kubernetes service to default zone
|
||||
ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Add SSH service to default zone (ensure SSH access)
|
||||
ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Reload firewalld to apply changes
|
||||
ansible.builtin.shell: firewall-cmd --reload
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Verify Kubernetes service is active
|
||||
ansible.builtin.shell: firewall-cmd --list-services
|
||||
register: active_services
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Display active firewall services
|
||||
ansible.builtin.debug:
|
||||
msg: "Active firewall services: {{ active_services.stdout }}"
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Install DNF plugins core for managing repositories
|
||||
ansible.builtin.dnf:
|
||||
name: dnf-plugins-core
|
||||
state: present
|
||||
|
||||
- name: Add Docker CE repository
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
|
||||
|
||||
- name: Install containerd
|
||||
ansible.builtin.dnf:
|
||||
name: containerd
|
||||
state: present
|
||||
|
||||
- name: Create containerd config directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/containerd
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Generate default containerd config and enable SystemdCgroup
|
||||
ansible.builtin.shell: |
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
|
||||
|
||||
- name: Restart and enable containerd service
|
||||
ansible.builtin.systemd:
|
||||
name: containerd
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: Add Kubernetes repository
|
||||
ansible.builtin.template:
|
||||
dest: /etc/yum.repos.d/kubernetes.repo
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
src: kubernetes.repo.j2
|
||||
|
||||
- name: Install Kubernetes packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
- kubectl
|
||||
- kubernetes-cni
|
||||
state: present
|
||||
|
||||
- name: Create kubelet config directory
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/kubelet
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Create initial kubelet config file
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/kubelet/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
kind: KubeletConfiguration
|
||||
cgroupDriver: systemd
|
||||
containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
|
||||
|
||||
- name: Install CNI plugins via dnf
|
||||
ansible.builtin.dnf:
|
||||
name: containernetworking-plugins
|
||||
state: present
|
||||
|
||||
- name: Verify CNI plugins installation
|
||||
ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
|
||||
register: cni_plugins
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display installed CNI plugins
|
||||
ansible.builtin.debug:
|
||||
msg: "CNI plugins status: {{ cni_plugins.stdout }}"
|
||||
|
||||
- name: Enable kubelet service (but don't start yet)
|
||||
ansible.builtin.systemd:
|
||||
name: kubelet
|
||||
enabled: true
|
||||
state: stopped
|
||||
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<short>Kubernetes</short>
|
||||
<description>Kubernetes cluster communication ports</description>
|
||||
{% for port in k8s_firewall_ports %}
|
||||
<port protocol="{{ port.protocol }}" port="{{ port.port }}"/>
|
||||
{% endfor %}
|
||||
</service>
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
[kubernetes]
|
||||
name=Kubernetes
|
||||
baseurl=https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | default('1.33') | regex_replace('^v?(.*)$', '\\1') | regex_replace('^(\\d+\\.\\d+).*$', '\\1') }}/rpm/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | default('1.33') | regex_replace('^v?(.*)$', '\\1') | regex_replace('^(\\d+\\.\\d+).*$', '\\1') }}/rpm/repodata/repomd.xml.key
|
||||
|
||||
@@ -1,11 +1,25 @@
|
||||
# ------------------------------------------------------------------------------
|
||||
# FILE: roles/common/tasks/main.yml
|
||||
# ------------------------------------------------------------------------------
|
||||
- name: Set Kubernetes-compatible hostname
|
||||
become: true
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
|
||||
when: kubernetes_hostnames is defined
|
||||
|
||||
- name: Remove zram-generator-defaults
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: zram-generator-defaults
|
||||
state: absent
|
||||
|
||||
- name: Disable swap
|
||||
ansible.builtin.command: swapoff -a
|
||||
become: true
|
||||
changed_when: false
|
||||
|
||||
- name: Persist swap off by commenting out swap in fstab
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
path: /etc/fstab
|
||||
regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
|
||||
@@ -13,6 +27,7 @@
|
||||
backup: true
|
||||
|
||||
- name: Load required kernel modules
|
||||
become: true
|
||||
community.general.modprobe:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
@@ -21,50 +36,121 @@
|
||||
- br_netfilter
|
||||
|
||||
- name: Persist kernel modules on boot
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/modules-load.d/k8s.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
overlay
|
||||
br_netfilter
|
||||
|
||||
- name: Configure required sysctl params for Kubernetes
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/sysctl.d/k8s.conf
|
||||
mode: '0644'
|
||||
content: |
|
||||
net.bridge.bridge-nf-call-iptables = 1
|
||||
net.bridge.bridge-nf-call-ip6tables = 1
|
||||
net.ipv4.ip_forward = 1
|
||||
|
||||
- name: Apply sysctl params without reboot
|
||||
become: true
|
||||
ansible.builtin.command: sysctl --system
|
||||
changed_when: false
|
||||
|
||||
- name: Install python3-libselinux for managing selinux
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: python3-libselinux
|
||||
state: present
|
||||
|
||||
- name: Set SELinux to permissive mode
|
||||
selinux:
|
||||
become: true
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: permissive
|
||||
|
||||
- name: Create Kubernetes service definition
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/firewalld/services/kubernetes.xml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<short>Kubernetes</short>
|
||||
<description>Kubernetes cluster communication ports</description>
|
||||
<port protocol="tcp" port="6443"/>
|
||||
<port protocol="tcp" port="2379"/>
|
||||
<port protocol="tcp" port="2380"/>
|
||||
<port protocol="tcp" port="10250"/>
|
||||
<port protocol="tcp" port="10251"/>
|
||||
<port protocol="tcp" port="10252"/>
|
||||
<port protocol="tcp" port="10255"/>
|
||||
<port protocol="tcp" port="30000-32767"/>
|
||||
<port protocol="udp" port="4789"/>
|
||||
<port protocol="tcp" port="179"/>
|
||||
</service>
|
||||
|
||||
- name: Reload firewalld to load new service
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --reload
|
||||
|
||||
- name: Add Kubernetes service to default zone
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --permanent --add-service=kubernetes
|
||||
|
||||
- name: Add SSH service to default zone (ensure SSH access)
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --permanent --add-service=ssh
|
||||
|
||||
- name: Reload firewalld to apply changes
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --reload
|
||||
|
||||
- name: Verify Kubernetes service is active
|
||||
become: true
|
||||
ansible.builtin.command: firewall-cmd --list-services
|
||||
register: firewall_services
|
||||
changed_when: false
|
||||
|
||||
- name: Display active firewall services
|
||||
ansible.builtin.debug:
|
||||
msg: "Active firewall services: {{ firewall_services.stdout }}"
|
||||
|
||||
- name: Install DNF plugins core for managing repositories
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: dnf-plugins-core
|
||||
state: present
|
||||
|
||||
- name: Add Docker CE repository
|
||||
ansible.builtin.command: dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
|
||||
args:
|
||||
creates: /etc/yum.repos.d/docker-ce.repo
|
||||
become: true
|
||||
ansible.builtin.yum_repository:
|
||||
name: docker-ce
|
||||
baseurl: https://download.docker.com/linux/fedora/docker-ce.repo
|
||||
gpgcheck: false
|
||||
enabled: true
|
||||
description: "Docker repository"
|
||||
|
||||
- name: Install containerd
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: containerd.io
|
||||
name: containerd
|
||||
state: present
|
||||
|
||||
- name: Create containerd config directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/containerd
|
||||
mode: '0755'
|
||||
state: directory
|
||||
|
||||
- name: Generate default containerd config and enable SystemdCgroup
|
||||
become: true
|
||||
ansible.builtin.shell: |
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
|
||||
@@ -72,6 +158,7 @@
|
||||
creates: /etc/containerd/config.toml
|
||||
|
||||
- name: Restart and enable containerd service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: containerd
|
||||
state: restarted
|
||||
@@ -79,6 +166,7 @@
|
||||
daemon_reload: true
|
||||
|
||||
- name: Add Kubernetes repository
|
||||
become: true
|
||||
ansible.builtin.yum_repository:
|
||||
name: kubernetes
|
||||
description: Kubernetes
|
||||
@@ -87,6 +175,7 @@
|
||||
gpgcheck: true
|
||||
|
||||
- name: Install Kubernetes packages
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- kubelet
|
||||
@@ -95,7 +184,73 @@
|
||||
state: present
|
||||
disable_excludes: kubernetes
|
||||
|
||||
- name: Enable the kubelet service
|
||||
- name: Create kubelet config directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/kubelet
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Create initial kubelet config file
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/kubelet/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
kind: KubeletConfiguration
|
||||
authentication:
|
||||
anonymous:
|
||||
enabled: false
|
||||
webhook:
|
||||
enabled: true
|
||||
x509:
|
||||
clientCAFile: /etc/kubernetes/pki/ca.crt
|
||||
authorization:
|
||||
mode: Webhook
|
||||
clusterDomain: cluster.local
|
||||
clusterDNS:
|
||||
- 10.96.0.10
|
||||
cpuManagerPolicy: none
|
||||
evictionHard:
|
||||
imagefs.available: 15%
|
||||
memory.available: 100Mi
|
||||
nodefs.available: 10%
|
||||
nodefs.inodesFree: 5%
|
||||
maxPods: 110
|
||||
podCIDR: {{ pod_network_cidr | default('10.244.0.0/16') }}
|
||||
resolvConf: /etc/resolv.conf
|
||||
runtimeRequestTimeout: 2m
|
||||
staticPodPath: /etc/kubernetes/manifests
|
||||
streamingConnectionIdleTimeout: 4h0m0s
|
||||
syncFrequency: 1m0s
|
||||
volumeStatsAggPeriod: 1m0s
|
||||
|
||||
- name: Install CNI plugins via dnf
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: containernetworking-plugins
|
||||
state: present
|
||||
|
||||
- name: Verify CNI plugins installation
|
||||
become: true
|
||||
ansible.builtin.command: ls -la /usr/libexec/cni/
|
||||
register: cni_plugins_list
|
||||
changed_when: false
|
||||
|
||||
|
||||
|
||||
- name: Display installed CNI plugins
|
||||
ansible.builtin.debug:
|
||||
msg: "Installed CNI plugins: {{ cni_plugins_list.stdout_lines }}"
|
||||
|
||||
- name: Enable and start the kubelet service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: kubelet
|
||||
enabled: true
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
46
ansible/playbooks/roles/ntp-server/tasks/main.yml
Normal file
46
ansible/playbooks/roles/ntp-server/tasks/main.yml
Normal file
@@ -0,0 +1,46 @@
|
||||
---
|
||||
# Role to install and configure an Chrony NTP server
|
||||
|
||||
- name: 1. Install Chrony NTP for time synchronization
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: chrony
|
||||
state: present
|
||||
|
||||
- name: 2.1 Remove DHCP NTP servers from config
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/chrony.conf
|
||||
line: "server unifi.int.mk-labs.cloud iburst"
|
||||
state: absent
|
||||
|
||||
- name: 2.2 Ensure specific NTP servers are present
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/chrony.conf
|
||||
line: "server {{ item }} iburst"
|
||||
state: present
|
||||
loop: "{{ ntp_servers }}"
|
||||
|
||||
- name: 3. Ensure network allowed are present
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/chrony.conf
|
||||
line: "allow {{ item }}"
|
||||
state: present
|
||||
loop: "{{ allowed_networks }}"
|
||||
|
||||
- name: 4.Restart ntpd service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: chronyd
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: 5. Allow NTP traffic
|
||||
become: true
|
||||
ansible.posix.firewalld:
|
||||
service: ntp
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
Reference in New Issue
Block a user