sync current state
This commit is contained in:
@@ -0,0 +1,47 @@
|
||||
---
|
||||
# Kubernetes Prerequisites Role Defaults
|
||||
|
||||
# Kubernetes version to install (should be overridden in group_vars)
|
||||
kubernetes_version: "v1.33"
|
||||
|
||||
# Container runtime (containerd is default)
|
||||
container_runtime: "containerd"
|
||||
|
||||
# CNI plugin to install
|
||||
cni_plugin: "calico"
|
||||
|
||||
# Firewall configuration
|
||||
configure_firewall: true
|
||||
|
||||
# Time synchronization
|
||||
configure_ntp: true
|
||||
|
||||
# SELinux configuration
|
||||
selinux_state: "permissive"
|
||||
|
||||
# Swap configuration
|
||||
disable_swap: true
|
||||
|
||||
# Kernel modules to load
|
||||
required_kernel_modules:
|
||||
- overlay
|
||||
- br_netfilter
|
||||
|
||||
# Sysctl parameters for Kubernetes
|
||||
k8s_sysctl_params:
|
||||
net.bridge.bridge-nf-call-iptables: 1
|
||||
net.bridge.bridge-nf-call-ip6tables: 1
|
||||
net.ipv4.ip_forward: 1
|
||||
|
||||
# Kubernetes firewall ports
|
||||
k8s_firewall_ports:
|
||||
- { protocol: "tcp", port: "6443" } # API server
|
||||
- { protocol: "tcp", port: "2379" } # etcd client
|
||||
- { protocol: "tcp", port: "2380" } # etcd peer
|
||||
- { protocol: "tcp", port: "10250" } # kubelet
|
||||
- { protocol: "tcp", port: "10251" } # kube-scheduler
|
||||
- { protocol: "tcp", port: "10252" } # kube-controller-manager
|
||||
- { protocol: "tcp", port: "10255" } # kubelet read-only
|
||||
- { protocol: "tcp", port: "30000-32767" } # NodePort services
|
||||
- { protocol: "udp", port: "4789" } # VXLAN (Flannel)
|
||||
- { protocol: "tcp", port: "179" } # BGP (Calico)
|
||||
210
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
Normal file
210
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
Normal file
@@ -0,0 +1,210 @@
|
||||
---
|
||||
- name: Set Kubernetes-compatible hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
|
||||
|
||||
- name: Remove zram-generator-defaults
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/zram-generator.conf
|
||||
state: absent
|
||||
|
||||
- name: Disable swap
|
||||
ansible.builtin.shell: swapoff -a
|
||||
when: disable_swap | default(true)
|
||||
|
||||
- name: Persist swap off by commenting out swap in fstab
|
||||
ansible.builtin.replace:
|
||||
path: /etc/fstab
|
||||
regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
|
||||
replace: '# \1'
|
||||
when: disable_swap | default(true)
|
||||
|
||||
- name: Load required kernel modules
|
||||
ansible.builtin.modprobe:
|
||||
name: "{{ item }}"
|
||||
loop: "{{ required_kernel_modules }}"
|
||||
|
||||
- name: Persist kernel modules on boot
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/modules-load.d/k8s.conf
|
||||
content: "{{ required_kernel_modules | join('\n') }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Configure required sysctl params for Kubernetes
|
||||
ansible.builtin.template:
|
||||
dest: /etc/sysctl.d/k8s.conf
|
||||
src: k8s-sysctl.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Apply sysctl params without reboot
|
||||
ansible.builtin.shell: sysctl --system
|
||||
|
||||
- name: Install python3-libselinux for managing selinux
|
||||
ansible.builtin.dnf:
|
||||
name: python3-libselinux
|
||||
state: present
|
||||
|
||||
- name: Set SELinux to permissive mode
|
||||
ansible.posix.selinux:
|
||||
policy: targeted
|
||||
state: "{{ selinux_state }}"
|
||||
|
||||
- name: Install and configure chrony for time synchronization
|
||||
ansible.builtin.dnf:
|
||||
name: chrony
|
||||
state: present
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Start and enable chronyd
|
||||
ansible.builtin.systemd:
|
||||
name: chronyd
|
||||
state: started
|
||||
enabled: true
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Force time synchronization
|
||||
ansible.builtin.shell: chronyc makestep
|
||||
ignore_errors: true
|
||||
when: configure_ntp | default(true)
|
||||
|
||||
- name: Install firewalld
|
||||
ansible.builtin.dnf:
|
||||
name: firewalld
|
||||
state: present
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Start and enable firewalld
|
||||
ansible.builtin.systemd:
|
||||
name: firewalld
|
||||
state: started
|
||||
enabled: true
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Create Kubernetes service definition
|
||||
ansible.builtin.template:
|
||||
dest: /etc/firewalld/services/kubernetes.xml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
src: kubernetes-firewall-service.xml.j2
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Reload firewalld to load new service
|
||||
ansible.builtin.shell: firewall-cmd --reload
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Add Kubernetes service to default zone
|
||||
ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Add SSH service to default zone (ensure SSH access)
|
||||
ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Reload firewalld to apply changes
|
||||
ansible.builtin.shell: firewall-cmd --reload
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Verify Kubernetes service is active
|
||||
ansible.builtin.shell: firewall-cmd --list-services
|
||||
register: active_services
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Display active firewall services
|
||||
ansible.builtin.debug:
|
||||
msg: "Active firewall services: {{ active_services.stdout }}"
|
||||
when: configure_firewall | default(true)
|
||||
|
||||
- name: Install DNF plugins core for managing repositories
|
||||
ansible.builtin.dnf:
|
||||
name: dnf-plugins-core
|
||||
state: present
|
||||
|
||||
- name: Add Docker CE repository
|
||||
ansible.builtin.shell: |
|
||||
curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
|
||||
|
||||
- name: Install containerd
|
||||
ansible.builtin.dnf:
|
||||
name: containerd
|
||||
state: present
|
||||
|
||||
- name: Create containerd config directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/containerd
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Generate default containerd config and enable SystemdCgroup
|
||||
ansible.builtin.shell: |
|
||||
containerd config default > /etc/containerd/config.toml
|
||||
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
|
||||
|
||||
- name: Restart and enable containerd service
|
||||
ansible.builtin.systemd:
|
||||
name: containerd
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
- name: Add Kubernetes repository
|
||||
ansible.builtin.template:
|
||||
dest: /etc/yum.repos.d/kubernetes.repo
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
src: kubernetes.repo.j2
|
||||
|
||||
- name: Install Kubernetes packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- kubelet
|
||||
- kubeadm
|
||||
- kubectl
|
||||
- kubernetes-cni
|
||||
state: present
|
||||
|
||||
- name: Create kubelet config directory
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/kubelet
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Create initial kubelet config file
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/kubelet/config.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
content: |
|
||||
apiVersion: kubelet.config.k8s.io/v1beta1
|
||||
kind: KubeletConfiguration
|
||||
cgroupDriver: systemd
|
||||
containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
|
||||
|
||||
- name: Install CNI plugins via dnf
|
||||
ansible.builtin.dnf:
|
||||
name: containernetworking-plugins
|
||||
state: present
|
||||
|
||||
- name: Verify CNI plugins installation
|
||||
ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
|
||||
register: cni_plugins
|
||||
ignore_errors: true
|
||||
|
||||
- name: Display installed CNI plugins
|
||||
ansible.builtin.debug:
|
||||
msg: "CNI plugins status: {{ cni_plugins.stdout }}"
|
||||
|
||||
- name: Enable kubelet service (but don't start yet)
|
||||
ansible.builtin.systemd:
|
||||
name: kubelet
|
||||
enabled: true
|
||||
state: stopped
|
||||
@@ -0,0 +1,9 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<service>
|
||||
<short>Kubernetes</short>
|
||||
<description>Kubernetes cluster communication ports</description>
|
||||
{% for port in k8s_firewall_ports %}
|
||||
<port protocol="{{ port.protocol }}" port="{{ port.port }}"/>
|
||||
{% endfor %}
|
||||
</service>
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
[kubernetes]
|
||||
name=Kubernetes
|
||||
baseurl=https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | default('1.33') | regex_replace('^v?(.*)$', '\\1') | regex_replace('^(\\d+\\.\\d+).*$', '\\1') }}/rpm/
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | default('1.33') | regex_replace('^v?(.*)$', '\\1') | regex_replace('^(\\d+\\.\\d+).*$', '\\1') }}/rpm/repodata/repomd.xml.key
|
||||
|
||||
Reference in New Issue
Block a user