Move ansible to it's own directory structure

ansible/playbooks/add_dhcp_entry.yml

@@ -0,0 +1,39 @@
+---
+- name: Add entry to DNSMasq
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Retrieve information about specific VM by name and get current configuration
+      delegate_to: "localhost"
+      community.proxmox.proxmox_vm_info:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        name: "{{ inventory_hostname }}"
+        config: current
+      register: proxmox_vm_info
+
+    - name: Extract net0 information
+      ansible.builtin.set_fact:
+        vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
+
+    - name: Extract MAC address using regex
+      ansible.builtin.set_fact:
+        vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
+
+    - name: Add line to hosts file
+      delegate_to: "{{ groups['dhcp_server'][0] }}"
+      become: true
+      ansible.builtin.lineinfile:
+        path: /etc/dnsmasq.d/hosts.conf
+        regexp: "# {{ inventory_hostname }}$"
+        line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
+        state: present
+    # restart dnsmasq service
+    - name: Restart service dnsmasq
+      delegate_to: "{{ groups['dhcp_server'][0] }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted

ansible/playbooks/add_dns_entry.yml

@@ -0,0 +1,17 @@
+---
+- name: Add entry to DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Create DNS entry for {{ inventory_hostname }}
+      delegate_to: "{{ groups['ipaserver'][0] }}"
+      freeipa.ansible_freeipa.ipadnsrecord:
+        ipaapi_context: "server"
+        ipaadmin_password: "{{ vault_freeipa_password }}"
+        name: "{{ inventory_hostname }}"
+        zone_name: "{{ base_domain }}"
+        record_type: "A"
+        record_value: "{{ ip_address }}"
+        record_ttl: 60
+        # create_reverse: yes

ansible/playbooks/configure_openshift_cluster.yml

@@ -0,0 +1,218 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: internal_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "internal_cluster"
+    download_dir: "/var/cache/openshift-install"
+
+  tasks:
+    - name: Remove previous directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: absent
+
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Check if OpenShift installer file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
+      register: openshift_installer_file
+
+    - name: Download and install OpenShift installer package
+      when: not openshift_installer_file.stat.exists
+      block:
+        - name: Download OpenShift Installer file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive installer file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy install binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift client file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
+      register: openshift_client_file
+
+    - name: Download and install OpenShift client package
+      when: not openshift_client_file.stat.exists
+      block:
+        - name: Download OpenShift Client file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive client file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy client binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

ansible/playbooks/configure_openshift_internal.yml

@@ -0,0 +1,218 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: internal_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "internal_cluster"
+    download_dir: "/var/cache/openshift-install"
+
+  tasks:
+    - name: Remove previous directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: absent
+
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Check if OpenShift installer file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
+      register: openshift_installer_file
+
+    - name: Download and install OpenShift installer package
+      when: not openshift_installer_file.stat.exists
+      block:
+        - name: Download OpenShift Installer file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive installer file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy install binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift client file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
+      register: openshift_client_file
+
+    - name: Download and install OpenShift client package
+      when: not openshift_client_file.stat.exists
+      block:
+        - name: Download OpenShift Client file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive client file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy client binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

ansible/playbooks/configure_prometheus.yml

@@ -0,0 +1,16 @@
+---
+- name: Master playbook to install and configure prometheus
+  hosts: prometheus_server
+  become: true
+
+  tasks:
+    - name: Permit traffic in default zone for dns service
+      firewalld:
+        port: 9090/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: prometheus.prometheus.prometheus

ansible/playbooks/configure_unbound.yml

@@ -0,0 +1,37 @@
+---
+- name: Master playbook to install and configure unbound
+  hosts: unbound_servers
+  become: true
+
+  tasks:
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        service: dns
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Create the directory
+      ansible.builtin.file:
+        path: /etc/systemd/resolved.conf.d
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Put `unbound.conf` in the correct place
+      ansible.builtin.copy:
+        src: ../roles/common/files/unbound.conf
+        dest: /etc/systemd/resolved.conf.d/unbound.conf
+        mode: '0644'
+        owner: root
+        group: root
+
+    - name: Restart service systemd-resolved
+      ansible.builtin.service:
+        name: systemd-resolved
+        state: restarted
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: Anthony25.unbound

ansible/playbooks/create_vm_from_clone.yml

@@ -0,0 +1,19 @@
+---
+- name: Master playbook to create VM from a template
+  hosts: all
+  gather_facts: false
+
+- name: Proxmox Clone VM Playbook
+  ansible.builtin.import_playbook: proxmox_clone_vm.yml
+
+- name: DNS Playbook
+  ansible.builtin.import_playbook: add_dns_entry.yml
+
+- name: DHCP Playbook
+  ansible.builtin.import_playbook: add_dhcp_entry.yml
+
+- name: Start VM Playbook
+  ansible.builtin.import_playbook: proxmox_start_vm.yml
+
+- name: Set Hostname Playbook
+  ansible.builtin.import_playbook: set_hostname.yml

ansible/playbooks/del_dns_entry.yml

@@ -0,0 +1,16 @@
+---
+- name: Remove entry from DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Delete DNS entry for {{ inventory_hostname }} #on {{ groups['ipa_servers'][0] }}
+      delegate_to: "{{ groups['ipaserver'][0] }}"
+      freeipa.ansible_freeipa.ipadnsrecord:
+        ipaapi_context: "server"
+        ipaadmin_password: "{{ vault_freeipa_password }}"
+        zone_name: "{{ base_domain }}"
+        records:
+          - name: "{{ inventory_hostname }}"
+            del_all: yes
+        state: absent

ansible/playbooks/idm-servers.yml

@@ -0,0 +1,10 @@
+---
+- name: Playbook to configure IPA server
+  hosts: ipaserver
+  become: true
+  vars_files:
+    - idm-vault.yml
+
+  roles:
+    - role: freeipa.ansible_freeipa.ipaserver
+      state: present

ansible/playbooks/monitoring.yml

@@ -0,0 +1,15 @@
+- name: Install Observability stack (targets)
+  hosts: target
+  tags:
+      - monitoring
+      - target
+  roles:
+      - ../roles/target
+
+- name: Install Observability stack (observer)
+  hosts: observer
+  tags:
+      - monitoring
+      - observer
+  roles:
+      - ../roles/observer

ansible/playbooks/proxmox_clone_vm.yml

@@ -0,0 +1,37 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Create Proxmox VMs
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      block:
+        - name: Create VM ID from IP address
+          ansible.builtin.set_fact:
+            vm_id: "{{ ip_address.split('.')[-2] }}{{ '%03d' % (ip_address.split('.')[-1] | int) }}"
+
+        - name: Clone VM with source vmid and target newid and raw format
+          community.proxmox.proxmox_kvm:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            clone: "{{ vm_clone_source }}"
+            newid: "{{ vm_id }}"
+            name: "{{ inventory_hostname }}"
+            node: "{{ proxmox_clone_node }}"
+            storage: "{{ vm_storage }}"
+            format: raw
+            timeout: 600
+
+        # - name: Add VM to HA group
+        #   community.proxmox.proxmox_cluster_ha_resources:
+        #     api_user: "{{ proxmox_user }}"
+        #     api_password: "{{ proxmox_password }}"
+        #     api_host: "{{ proxmox_host }}"
+        #     name: vm:"{{ vm_id }}"
+        #     state: "present"
+        #     group: "{{ ha_group }}"
+        #     max_relocate: 2
+        #     max_restart: 2

ansible/playbooks/proxmox_start_vm.yml

@@ -0,0 +1,32 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Start Proxmox VM
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        name: "{{ inventory_hostname }}"
+        node: "{{ proxmox_clone_node }}"
+        state: started
+
+    # - name: Wait for the VM to start
+    #   delegate_to: "localhost"
+    #   wait_for:
+    #     port: 22
+    #     host: "{{ inventory_hostname }}"
+    #     search_regex: OpenSSH
+    #     delay: 10
+    #     timeout: 60
+
+    # - name: Wait for the reboot to complete if there was a change.
+    #   wait_for_connection:
+    #     connect_timeout: 10
+    #     sleep: 5
+    #     delay: 5
+    #     timeout: 300

ansible/playbooks/set_hostname.yml

@@ -0,0 +1,11 @@
+---
+- name: Set hostname of VM
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Set hostname of VM
+      become: true
+      delegate_to: "{{ inventory_hostname }}"
+      ansible.builtin.hostname:
+        name: "{{ hostname }}"

ansible/playbooks/tasks/configure_dhcp_entry.yml

@@ -0,0 +1,10 @@
+---
+- name: Add DHCP entry for {{ inventory_hostname }}
+  delegate_to: "{{ dhcp_server }}"
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dnsmasq.d/hosts.conf
+    regexp: "# {{ inventory_hostname }}$"
+    line: "dhcp-host={{ host_mac_address | lower }},{{ host_ip_address }} # {{ inventory_hostname }}"
+    state: present
+  notify: Restart dnsmasq

ansible/playbooks/tasks/create_dns_record.yml

@@ -0,0 +1,11 @@
+---
+- name: "Create DNS record for {{ dns_name | default(inventory_hostname) }}"
+  delegate_to: "{{ dns_server }}"
+  freeipa.ansible_freeipa.ipadnsrecord:
+    ipaapi_context: "server"
+    ipaadmin_password: "{{ vault_freeipa_password }}"
+    name: "{{ dns_name | default(inventory_hostname) }}"
+    zone_name: "{{ base_domain }}"
+    record_type: "A"
+    record_value: "{{ dns_address | default(host_ip_address) }}"
+    record_ttl: 60

ansible/playbooks/templates/agent-config.yaml.j2

@@ -0,0 +1,40 @@
+apiVersion: v1alpha1
+kind: AgentConfig
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+rendezvousIP: {{ hostvars[groups[cluster_group][0]].ip_address }}
+bootArtifactsBaseURL: {{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/hub/
+hosts:
+{% for host in groups[cluster_group] %}
+  - hostname: {{ host }}
+    role: {{ hostvars[host].node_role | default('master') }}
+    interfaces:
+      - name: {{ hostvars[host].primary_interface }}
+        macAddress: {{ hostvars[host].install_mac_address }}
+    networkConfig:
+      interfaces:
+        - name: {{ hostvars[host].primary_interface }}
+          type: ethernet
+          state: up
+          identifier: mac-address
+          mac-address: {{ hostvars[host].install_mac_address }}
+          ipv4:
+            enabled: true
+            dhcp: true
+        - name: {{ hostvars[host].boot_interface }}
+          type: ethernet
+          state: down
+          identifier: mac-address
+          mac-address: {{ hostvars[host].boot_mac_address }}
+      dns-resolver:
+        config:
+          server:
+            - 10.1.71.251
+            - 10.1.71.252
+      routes:
+        config:
+          - destination: 0.0.0.0/0
+            next-hop-address: 10.1.71.1
+            next-hop-interface: {{ hostvars[host].primary_interface }}
+            table-id: 254
+{% endfor %}

ansible/playbooks/templates/groups.tf.j2

@@ -0,0 +1,14 @@
+// Matcher group for OCP Internal machines
+{% for host in groups[cluster_group] %}
+resource "matchbox_group" "{{ host }}" {
+  name = "{{ host }}" # Physical Server
+  profile = matchbox_profile.openshift-agent-install.name
+  selector = {
+{% if hostvars[host].boot_mac_address == hostvars[host].install_mac_address %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots and installs to same NIC
+{% else %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots to 1GbE NIC, installs to 10GbE NIC
+{% endif %}
+  }
+}
+{% endfor %}

ansible/playbooks/templates/install-config.yaml.j2

@@ -0,0 +1,28 @@
+apiVersion: v1
+baseDomain: {{ hostvars[groups[cluster_group][0]].base_domain }}
+compute:
+- name: worker
+  hyperthreading: Enabled
+  replicas: {{ hostvars[groups[cluster_group][0]].worker_node_count }}
+controlPlane:
+  hyperthreading: Enabled
+  name: master
+  replicas: {{ hostvars[groups[cluster_group][0]].master_node_count }}
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+networking:
+  clusterNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].cluster_network }}
+    hostPrefix: {{ hostvars[groups[cluster_group][0]].cluster_network_host_prefix }}
+  machineNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].machine_network }}
+  networkType: OVNKubernetes
+  serviceNetwork:
+  - {{ hostvars[groups[cluster_group][0]].service_network }}
+platform:
+  {{ hostvars[groups[cluster_group][0]].platform_type }}:
+    apiVIP: {{ hostvars[groups[cluster_group][0]].api_address }}
+    ingressVIP: {{ hostvars[groups[cluster_group][0]].app_address }}
+fips: false
+pullSecret: '{{ vault_pull_secret }}'
+sshKey: '{{ vault_ssh_key }}'

ansible/playbooks/templates/profiles.tf.j2

@@ -0,0 +1,16 @@
+// Fedora CoreOS profile
+resource "matchbox_profile" "openshift-agent-install" {
+  name   = "{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+  kernel = "/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-vmlinuz"
+  initrd = [
+    "--name initrd /assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-initrd.img"
+  ]
+
+  args = [
+    "initrd=initrd",
+    "coreos.live.rootfs_url={{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-rootfs.img",
+    "rw",
+    "ignition.firstboot",
+    "ignition.platform.id=metal",
+  ]
+}

ansible/playbooks/templates/provider.tf.j2

@@ -0,0 +1,20 @@
+// Configure the matchbox provider
+provider "matchbox" {
+  endpoint    = "{{ hostvars[groups['matchbox_server'][0]].rpc_endpoint }}"
+  client_cert = file("/etc/matchbox/client.crt")
+  client_key  = file("/etc/matchbox/client.key")
+  ca          = file("/etc/matchbox/ca.crt")
+}
+
+terraform {
+  required_providers {
+    ct = {
+      source  = "poseidon/ct"
+      version = "0.13.0"
+    }
+    matchbox = {
+      source  = "poseidon/matchbox"
+      version = "0.5.4"
+    }
+  }
+}

ansible/playbooks/update-linux-os.yml

@@ -0,0 +1,121 @@
+---
+- name: Linux OS Upgrade
+  hosts: all
+  gather_facts: true
+  become: true
+
+  tasks:
+    - name: Update all packages
+      ansible.builtin.package:
+        name: '*'
+        state: latest
+        update_cache: true
+
+    - name: Upgrade Debian and Ubuntu systems with apt
+      when: ansible_os_family == "Debian"
+      block:
+        - name: Dist-upgrade
+          ansible.builtin.apt:
+            upgrade: dist
+            update_cache: true
+          register: upgrade_result
+
+        - name: Debain check if reboot is required
+          ansible.builtin.shell: "[ -f /var/run/reboot-required ]"
+          failed_when: false
+          register: debian_reboot_required
+          changed_when: debian_reboot_required.rc == 0
+          notify:
+            - Reboot server
+
+        - name: Debian remove unneeded dependencies
+          ansible.builtin.apt:
+            autoremove: true
+          register: autoremove_result
+
+        - name: Debian print errors if upgrade failed
+          ansible.builtin.debug:
+            msg: |
+              Upgrade Result: {{ upgrade_result }}
+              Autoremove Result: {{ autoremove_result }}
+
+    - name: Upgrade RHEL systems with DNF
+      when: ansible_os_family == "RedHat" and not (ansible_distribution_major_version == "7")
+      block:
+        - name: Get packages that can be upgraded with DNF
+          ansible.builtin.dnf:
+            list: upgrades
+            state: latest
+            update_cache: true
+          register: reg_dnf_output_all
+
+        - name: List packages that can be upgraded with DNF
+          ansible.builtin.debug:
+            msg: "{{ reg_dnf_output_all.results | map(attribute='name') | list }}"
+
+        - name: Upgrade packages with DNF
+          become: true
+          ansible.builtin.dnf:
+            name: '*'
+            state: latest
+            update_cache: true
+            update_only: false
+          register: reg_upgrade_ok
+
+        - name: Print DNF errors if upgrade failed
+          ansible.builtin.debug:
+            msg: "Packages upgrade failed"
+          when: reg_upgrade_ok is not defined
+
+        - name: Install dnf-utils
+          when: reg_dnf_output_all is defined
+          become: true
+          ansible.builtin.dnf:
+            name: 'dnf-utils'
+            state: latest
+            update_cache: true
+
+    - name: Upgrade legacy RHEL systems with YUM
+      when: ansible_os_family == "RedHat" and ansible_distribution_major_version == "7"
+      block:
+        - name: Get packages that can be upgraded with YUM
+          ansible.builtin.yum:
+            list: upgrades
+            state: latest
+            update_cache: true
+          register: reg_yum_output_all
+
+        - name: List packages that can be upgraded with YUM
+          ansible.builtin.debug:
+            msg: "{{ reg_yum_output_all.results | map(attribute='name') | list }}"
+
+        - name: Upgrade packages with YUM
+          become: true
+          ansible.builtin.yum:
+            name: '*'
+            state: latest
+            update_cache: true
+            update_only: false
+          register: reg_yum_upgrade_ok
+
+        - name: Print YUM errors if upgrade failed
+          ansible.builtin.debug:
+            msg: "Packages upgrade failed"
+          when: reg_yum_upgrade_ok is not defined
+
+        - name: Check legacy RHEL system if a reboot is required
+          become: true
+          ansible.builtin.command: needs-restarting -r
+          register: reg_reboot_required
+          ignore_errors: true
+          failed_when: false
+          changed_when: reg_reboot_required.rc != 0
+          notify:
+            - Reboot server
+
+  handlers:
+    - name: Reboot server
+      ansible.builtin.reboot:
+        msg: "Reboot initiated by Ansible after OS update"
+        reboot_timeout: 3600
+        test_command: uptime