sync current state

ansible/roles/fastpass-kubernetes/tasks/container-runtime.yml

@@ -0,0 +1,72 @@
+---
+# Container runtime setup for Kubernetes
+
+- name: Add containerd repository
+  become: true
+  ansible.builtin.yum_repository:
+    name: docker-ce
+    description: "Docker CE Repository"
+    baseurl: "https://download.docker.com/linux/fedora/{{ ansible_distribution_major_version }}/x86_64/stable"
+    gpgkey: "https://download.docker.com/linux/fedora/gpg"
+    gpgcheck: true
+    enabled: true
+    state: present
+
+- name: Install containerd
+  become: true
+  ansible.builtin.dnf:
+    name: containerd
+    state: present
+    disable_excludes: docker-ce-stable
+
+- name: Create containerd config directory
+  become: true
+  ansible.builtin.file:
+    path: /etc/containerd
+    state: directory
+    mode: '0755'
+
+- name: Generate default containerd config
+  become: true
+  ansible.builtin.shell: |
+    containerd config default > /etc/containerd/config.toml
+  args:
+    creates: /etc/containerd/config.toml
+
+- name: Configure containerd for Kubernetes
+  become: true
+  ansible.builtin.replace:
+    path: /etc/containerd/config.toml
+    regexp: 'SystemdCgroup = false'
+    replace: 'SystemdCgroup = true'
+
+- name: Create containerd service override directory
+  become: true
+  ansible.builtin.file:
+    path: /etc/systemd/system/containerd.service.d
+    state: directory
+    mode: '0755'
+
+- name: Configure containerd service override
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/containerd.service.d/override.conf
+    content: |
+      [Service]
+      ExecStartPre=-/sbin/modprobe overlay
+      ExecStartPre=-/sbin/modprobe br_netfilter
+    mode: '0644'
+
+- name: Restart and enable containerd service
+  become: true
+  ansible.builtin.systemd:
+    name: containerd
+    state: restarted
+    enabled: true
+    daemon_reload: true
+
+- name: Verify containerd is running
+  become: true
+  ansible.builtin.systemd:
+    name: containerd
+    state: started 

ansible/roles/fastpass-kubernetes/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+# FastPass Kubernetes Cluster Preparation for Fedora
+# This role prepares all nodes for Kubernetes installation
+
+- name: Include preflight checks
+  ansible.builtin.include_tasks: preflight.yml
+  when: preflight_checks | default(true)
+
+- name: Include system preparation
+  ansible.builtin.include_tasks: system-prep.yml
+
+- name: Include container runtime setup
+  ansible.builtin.include_tasks: container-runtime.yml
+
+- name: Include Kubernetes installation
+  ansible.builtin.include_tasks: kubernetes-install.yml 

ansible/roles/fastpass-kubernetes/tasks/preflight.yml

@@ -0,0 +1,40 @@
+---
+# Preflight checks for Kubernetes installation
+
+- name: Check if running on supported OS
+  ansible.builtin.assert:
+    that:
+      - ansible_os_family == "RedHat"
+      - ansible_distribution == "Fedora"
+    fail_msg: "This role only supports Fedora"
+    success_msg: "OS check passed"
+
+- name: Check minimum memory requirement (2GB)
+  ansible.builtin.assert:
+    that: ansible_memtotal_mb >= 2048
+    fail_msg: "Minimum 2GB RAM required, found {{ ansible_memtotal_mb }}MB"
+    success_msg: "Memory check passed: {{ ansible_memtotal_mb }}MB"
+
+- name: Check minimum CPU cores (2)
+  ansible.builtin.assert:
+    that: ansible_processor_cores >= 2
+    fail_msg: "Minimum 2 CPU cores required, found {{ ansible_processor_cores }}"
+    success_msg: "CPU check passed: {{ ansible_processor_cores }} cores"
+
+- name: Check available disk space (10GB)
+  ansible.builtin.assert:
+    that: ansible_mounts | selectattr('mount', 'equalto', '/') | map(attribute='size_available') | first >= 10737418240
+    fail_msg: "Minimum 10GB free space required on root filesystem"
+    success_msg: "Disk space check passed"
+
+- name: Check if system is 64-bit
+  ansible.builtin.assert:
+    that: ansible_architecture in ['x86_64', 'amd64']
+    fail_msg: "Only 64-bit architectures are supported"
+    success_msg: "Architecture check passed: {{ ansible_architecture }}"
+
+- name: Check if running as root or with sudo
+  ansible.builtin.assert:
+    that: ansible_become | default(false)
+    fail_msg: "This role requires root privileges (become: true)"
+    success_msg: "Privilege check passed" 

ansible/roles/fastpass-kubernetes/tasks/system-prep.yml

@@ -0,0 +1,83 @@
+---
+# System preparation for Kubernetes
+
+- name: Disable swap
+  ansible.builtin.command: swapoff -a
+  become: true
+  changed_when: false
+  when: disable_swap | default(true)
+
+- name: Persist swap off by commenting out swap in fstab
+  become: true
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
+    replace: '#\2'
+    backup: true
+  when: disable_swap | default(true)
+
+- name: Load required kernel modules
+  become: true
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - overlay
+    - br_netfilter
+
+- name: Persist kernel modules on boot
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k8s.conf
+    content: |
+      overlay
+      br_netfilter
+    mode: '0644'
+
+- name: Configure required sysctl params for Kubernetes
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/k8s.conf
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+    mode: '0644'
+
+- name: Apply sysctl params without reboot
+  become: true
+  ansible.builtin.command: sysctl --system
+  changed_when: false
+
+- name: Install required packages
+  become: true
+  ansible.builtin.dnf:
+    name:
+      - python3-libselinux
+      - dnf-plugins-core
+      - curl
+      - wget
+      - ca-certificates
+    state: present
+
+- name: Set SELinux to permissive mode
+  become: true
+  ansible.posix.selinux:
+    policy: targeted
+    state: "{{ selinux_mode | default('permissive') }}"
+
+- name: Stop and disable firewalld
+  become: true
+  ansible.builtin.systemd:
+    name: firewalld
+    state: stopped
+    enabled: false
+  when: not firewall_enabled | default(false)
+
+- name: Update system packages
+  become: true
+  ansible.builtin.dnf:
+    name: "*"
+    state: latest
+  async: 300
+  poll: 10