sync current state

ansible/roles/fastpass-kubernetes/tasks/system-prep.yml

@@ -0,0 +1,83 @@
+---
+# System preparation for Kubernetes
+
+- name: Disable swap
+  ansible.builtin.command: swapoff -a
+  become: true
+  changed_when: false
+  when: disable_swap | default(true)
+
+- name: Persist swap off by commenting out swap in fstab
+  become: true
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
+    replace: '#\2'
+    backup: true
+  when: disable_swap | default(true)
+
+- name: Load required kernel modules
+  become: true
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - overlay
+    - br_netfilter
+
+- name: Persist kernel modules on boot
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k8s.conf
+    content: |
+      overlay
+      br_netfilter
+    mode: '0644'
+
+- name: Configure required sysctl params for Kubernetes
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/k8s.conf
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+    mode: '0644'
+
+- name: Apply sysctl params without reboot
+  become: true
+  ansible.builtin.command: sysctl --system
+  changed_when: false
+
+- name: Install required packages
+  become: true
+  ansible.builtin.dnf:
+    name:
+      - python3-libselinux
+      - dnf-plugins-core
+      - curl
+      - wget
+      - ca-certificates
+    state: present
+
+- name: Set SELinux to permissive mode
+  become: true
+  ansible.posix.selinux:
+    policy: targeted
+    state: "{{ selinux_mode | default('permissive') }}"
+
+- name: Stop and disable firewalld
+  become: true
+  ansible.builtin.systemd:
+    name: firewalld
+    state: stopped
+    enabled: false
+  when: not firewall_enabled | default(false)
+
+- name: Update system packages
+  become: true
+  ansible.builtin.dnf:
+    name: "*"
+    state: latest
+  async: 300
+  poll: 10