rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ansible scripts done to install kubewrnetes prequesites

Browse Source
This commit is contained in:
Ryan Blundon
2025-09-27 16:05:33 -05:00
parent 6107e474c1
commit 6f5bc65171
31 changed files with 498 additions and 406 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
ansible/playbooks/roles/containerd/README.md Normal file
View File

@@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

3
ansible/playbooks/roles/containerd/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for containerd

3
ansible/playbooks/roles/containerd/handlers/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for containerd

35
ansible/playbooks/roles/containerd/meta/main.yml Normal file
View File

@@ -0,0 +1,35 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

74
ansible/playbooks/roles/containerd/tasks/main.yml Normal file
View File

@@ -0,0 +1,74 @@
---
# tasks file for containerd
- name: Install containerd dependencies
become: true
ansible.builtin.package:
name: "{{ item }}"
state: present
loop:
"{{ containerd_dependencies }}"
- name: Install via apt
become: true
when: ansible_os_family == "Debian"
block:
- name: Add repo using key from URL (apt)
ansible.builtin.deb822_repository:
name: docker
types: deb
uris: https://download.docker.com/linux/ubuntu
suites: "{{ ansible_distribution_release }}"
components: stable
architectures: amd64
signed_by: https://download.docker.com/linux/ubuntu/gpg
- name: Update apt cache
ansible.builtin.apt:
update_cache: true
- name: Install via dnf
become: true
when: ansible_os_family == "RedHat"
block:
- name: Add repo using key from URL (dnf)
ansible.builtin.yum_repository:
name: docker
description: "Docker repository"
baseurl: https://download.docker.com/linux/ubuntu
gpgcheck: true
gpgkey: https://download.docker.com/linux/ubuntu/gpg
- name: Update dnf cache
ansible.builtin.dnf:
update_cache: true
- name: Install containerd
become: true
ansible.builtin.package:
name: containerd.io
state: present
- name: Create containerd config directory
ansible.builtin.file:
path: /etc/containerd
state: directory
owner: root
group: root
mode: '0755'
- name: Check if containerd config file exists
ansible.builtin.stat:
path: /etc/containerd/config.toml
register: containerd_config_file
- name: Generate default containerd config and enable SystemdCgroup
when: containerd_config_file.stat.exists == false
ansible.builtin.shell: |
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
- name: Restart and enable containerd service
ansible.builtin.systemd:
name: containerd
state: restarted
enabled: true

3
ansible/playbooks/roles/containerd/tests/inventory Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/containerd/tests/test.yml Normal file
View File

@@ -0,0 +1,6 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- containerd

3
ansible/playbooks/roles/containerd/vars/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for containerd

31
ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml
View File

@@ -2,17 +2,11 @@
# Kubernetes Prerequisites Role Defaults
# Kubernetes version to install (should be overridden in group_vars)
kubernetes_version: "v1.30"
# Container runtime (containerd is default)
container_runtime: "containerd"
kubernetes_version: "v1.33"
# CNI plugin to install
cni_plugin: "calico"
# Firewall configuration
configure_firewall: true
# SELinux configuration
selinux_state: "permissive"
@@ -27,15 +21,14 @@ k8s_sysctl_params:
- "net.bridge.bridge-nf-call-ip6tables: 1"
- "net.ipv4.ip_forward: 1"
# Kubernetes firewall ports
k8s_firewall_ports:
- { protocol: "tcp", port: "6443" } # API server
- { protocol: "tcp", port: "2379" } # etcd client
- { protocol: "tcp", port: "2380" } # etcd peer
- { protocol: "tcp", port: "10250" } # kubelet
- { protocol: "tcp", port: "10251" } # kube-scheduler
- { protocol: "tcp", port: "10252" } # kube-controller-manager
- { protocol: "tcp", port: "10255" } # kubelet read-only
- { protocol: "tcp", port: "30000-32767" } # NodePort services
- { protocol: "udp", port: "4789" } # VXLAN (Flannel)
- { protocol: "tcp", port: "179" } # BGP (Calico)
containerd_dependencies:
- curl
- gnupg2
- software-properties-common
- apt-transport-https
- ca-certificates
kubernetes_packages:
- kubelet
- kubeadm
- kubectl

189
ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml
View File

@@ -9,176 +9,71 @@
ansible.builtin.include_role:
name: no-swap
- name: 3.1 Load required kernel modules
become: true
ansible.builtin.modprobe:
name: "{{ item }}"
loop: "{{ required_kernel_modules }}"
- name: 3.2 Persist kernel modules on boot
become: true
ansible.builtin.copy:
dest: /etc/modules-load.d/k8s.conf
content: "{{ required_kernel_modules | join('\n') }}"
owner: root
group: root
mode: '0644'
- name: 3.3 Configure required sysctl params for Kubernetes
become: true
ansible.builtin.copy:
dest: /etc/sysctl.d/kubernetes.conf
content: "{{ k8s_sysctl_params | join('\n') }}"
owner: root
group: root
mode: '0644'
- name: 3.4 Apply sysctl params without reboot
become: true
ansible.builtin.shell: sysctl --system
- name: 3.5 Manage SELinux
- name: 3. Manage SELinux
become: true
when: ansible_os_family == "RedHat"
block:
- name: 3.5.1 Install python3-libselinux for managing selinux
- name: 3.1 Install python3-libselinux for managing selinux
ansible.builtin.dnf:
name: python3-libselinux
state: present
- name: 3.5.2 Set SELinux to permissive mode
- name: 3.2 Set SELinux to permissive mode
ansible.posix.selinux:
policy: targeted
state: "{{ selinux_state }}"
- name: 4 Manage Time Synchronization
ansible.builtin.include_role:
name: time-sync
- name: 5.1 Manage firewall (ufw)
become: true
when: ansible_os_family == "Debian"
block:
- name: Check if ntp is installed
ansible.builtin.package: rpm -q ntp
register: ntp_installed
changed_when: false
- name: 4.1 Remove the ntp package
- name: 5.1.1 Install ufw
ansible.builtin.package:
name: ntp
state: absent
- name: 4.2 Install the chrony package
ansible.builtin.package:
name: chrony
name: ufw
state: present
- name: 5.1.2 Open firewall ports OpenSSH
community.general.ufw:
rule: allow
name: OpenSSH
# - name: Start and enable chronyd
# ansible.builtin.systemd:
# name: chronyd
# state: started
# enabled: true
# when: configure_ntp | default(true)
- name: 5.1.3 Enable ufw
community.general.ufw:
state: enabled
# - name: Force time synchronization
# ansible.builtin.shell: chronyc makestep
# ignore_errors: true
# when: configure_ntp | default(true)
- name: 5.2 Manage firewall (firewalld)
become: true
when: ansible_os_family == "RedHat"
block:
- name: 5.2.1 Install firewalld
ansible.builtin.package:
name: firewalld
state: present
# - name: Install firewalld
# ansible.builtin.dnf:
# name: firewalld
# state: present
# when: configure_firewall | default(true)
- name: 5.2.2 Add SSH service to default zone (ensure SSH access)
ansible.posix.firewalld:
service: ssh
permanent: true
immediate: true
state: enabled
# - name: Start and enable firewalld
# ansible.builtin.systemd:
# name: firewalld
# state: started
# enabled: true
# when: configure_firewall | default(true)
- name: 5.2.3 Start and enable firewalld
ansible.builtin.systemd:
name: firewalld
state: started
enabled: true
# - name: Create Kubernetes service definition
# ansible.builtin.template:
# dest: /etc/firewalld/services/kubernetes.xml
# owner: root
# group: root
# mode: '0644'
# src: kubernetes-firewall-service.xml.j2
# when: configure_firewall | default(true)
- name: 6 Install kubernetes
ansible.builtin.include_role:
name: kubernetes
# - name: Reload firewalld to load new service
# ansible.builtin.shell: firewall-cmd --reload
# when: configure_firewall | default(true)
# - name: Add Kubernetes service to default zone
# ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
# when: configure_firewall | default(true)
# - name: Add SSH service to default zone (ensure SSH access)
# ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
# when: configure_firewall | default(true)
# - name: Reload firewalld to apply changes
# ansible.builtin.shell: firewall-cmd --reload
# when: configure_firewall | default(true)
# - name: Verify Kubernetes service is active
# ansible.builtin.shell: firewall-cmd --list-services
# register: active_services
# when: configure_firewall | default(true)
# - name: Display active firewall services
# ansible.builtin.debug:
# msg: "Active firewall services: {{ active_services.stdout }}"
# when: configure_firewall | default(true)
# - name: Install DNF plugins core for managing repositories
# ansible.builtin.dnf:
# name: dnf-plugins-core
# state: present
# - name: Add Docker CE repository
# ansible.builtin.shell: |
# curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
# - name: Install containerd
# ansible.builtin.dnf:
# name: containerd
# state: present
# - name: Create containerd config directory
# ansible.builtin.file:
# path: /etc/containerd
# state: directory
# owner: root
# group: root
# mode: '0755'
# - name: Generate default containerd config and enable SystemdCgroup
# ansible.builtin.shell: |
# containerd config default > /etc/containerd/config.toml
# sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
# - name: Restart and enable containerd service
# ansible.builtin.systemd:
# name: containerd
# state: restarted
# enabled: true
# - name: Add Kubernetes repository
# ansible.builtin.template:
# dest: /etc/yum.repos.d/kubernetes.repo
# owner: root
# group: root
# mode: '0644'
# src: kubernetes.repo.j2
# - name: Install Kubernetes packages
# ansible.builtin.dnf:
# name:
# - kubelet
# - kubeadm
# - kubectl
# - kubernetes-cni
# state: present
- name: 7 Install containerd
ansible.builtin.include_role:
name: containerd
# - name: Create kubelet config directory
# ansible.builtin.file:

9
ansible/playbooks/roles/kubernetes-prerequisites/templates/kubernetes-firewall-service.xml.j2
View File

@@ -1,9 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>Kubernetes</short>
<description>Kubernetes cluster communication ports</description>
{% for port in k8s_firewall_ports %}
<port protocol="{{ port.protocol }}" port="{{ port.port }}"/>
{% endfor %}
</service>

38
ansible/playbooks/roles/kubernetes/README.md Normal file
View File

@@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

3
ansible/playbooks/roles/kubernetes/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for kubernetes

3
ansible/playbooks/roles/kubernetes/handlers/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for kubernetes

35
ansible/playbooks/roles/kubernetes/meta/main.yml Normal file
View File

@@ -0,0 +1,35 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

289
ansible/playbooks/roles/kubernetes/tasks/main.yml
View File

@@ -1,256 +1,97 @@
# ------------------------------------------------------------------------------
# FILE: roles/common/tasks/main.yml
# ------------------------------------------------------------------------------
- name: Set Kubernetes-compatible hostname
become: true
ansible.builtin.hostname:
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
when: kubernetes_hostnames is defined
- name: Remove zram-generator-defaults
become: true
ansible.builtin.dnf:
name: zram-generator-defaults
state: absent
- name: Disable swap
ansible.builtin.command: swapoff -a
become: true
changed_when: false
- name: Persist swap off by commenting out swap in fstab
become: true
ansible.builtin.replace:
path: /etc/fstab
regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
replace: '#\2'
backup: true
---
# tasks file for kubernetes
- name: Load required kernel modules
become: true
community.general.modprobe:
name: "{{ item }}"
state: present
loop:
- overlay
- br_netfilter
loop: "{{ required_kernel_modules }}"
- name: Persist kernel modules on boot
become: true
ansible.builtin.copy:
dest: /etc/modules-load.d/k8s.conf
content: "{{ required_kernel_modules | join('\n') }}"
owner: root
group: root
mode: '0644'
content: |
overlay
br_netfilter
- name: Configure required sysctl params for Kubernetes
become: true
ansible.builtin.copy:
dest: /etc/sysctl.d/k8s.conf
dest: /etc/sysctl.d/kubernetes.conf
content: "{{ k8s_sysctl_params | join('\n') }}"
owner: root
group: root
mode: '0644'
content: |
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
- name: Apply sysctl params without reboot
become: true
ansible.builtin.command: sysctl --system
changed_when: false
- name: Install python3-libselinux for managing selinux
- name: Manage firewall (ufw)
become: true
ansible.builtin.dnf:
name: python3-libselinux
state: present
when: ansible_os_family == "Debian"
block:
- name: Create Kubernetes service definition (ufw)
ansible.builtin.template:
dest: /etc/ufw/applications.d/kubernetes
owner: root
group: root
mode: '0644'
src: kubernetes-ufw-service.xml.j2
- name: Set SELinux to permissive mode
- name: Manage firewall (firewalld)
become: true
ansible.posix.selinux:
policy: targeted
state: permissive
when: ansible_os_family == "RedHat"
block:
- name: Create Kubernetes service definition (firewalld)
ansible.builtin.template:
dest: /etc/firewalld/services/kubernetes.xml
owner: root
group: root
mode: '0644'
src: kubernetes-firewalld-service.xml.j2
- name: Create Kubernetes service definition
- name: Install via apt
become: true
ansible.builtin.copy:
dest: /etc/firewalld/services/kubernetes.xml
owner: root
group: root
mode: '0644'
content: |
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>Kubernetes</short>
<description>Kubernetes cluster communication ports</description>
<port protocol="tcp" port="6443"/>
<port protocol="tcp" port="2379"/>
<port protocol="tcp" port="2380"/>
<port protocol="tcp" port="10250"/>
<port protocol="tcp" port="10251"/>
<port protocol="tcp" port="10252"/>
<port protocol="tcp" port="10255"/>
<port protocol="tcp" port="30000-32767"/>
<port protocol="udp" port="4789"/>
<port protocol="tcp" port="179"/>
</service>
when: ansible_os_family == "Debian"
block:
- name: Add Kubernetes apt key
ansible.builtin.apt_key:
url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version }}/deb/Release.key"
state: present
- name: Reload firewalld to load new service
- name: Add Kubernetes repository
ansible.builtin.apt_repository:
repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /"
state: present
filename: kubernetes
- name: Update apt cache
ansible.builtin.apt:
update_cache: true
- name: Install via dnf (may not work)
become: true
ansible.builtin.command: firewall-cmd --reload
when: ansible_os_family == "RedHat"
block:
- name: Add repo using key from URL (dnf)
ansible.builtin.yum_repository:
name: kubernetes
description: "Kubernetes repository"
baseurl: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/
gpgcheck: true
gpgkey: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/repodata/repomd.xml.key
- name: Add Kubernetes service to default zone
become: true
ansible.builtin.command: firewall-cmd --permanent --add-service=kubernetes
- name: Add SSH service to default zone (ensure SSH access)
become: true
ansible.builtin.command: firewall-cmd --permanent --add-service=ssh
- name: Reload firewalld to apply changes
become: true
ansible.builtin.command: firewall-cmd --reload
- name: Verify Kubernetes service is active
become: true
ansible.builtin.command: firewall-cmd --list-services
register: firewall_services
changed_when: false
- name: Display active firewall services
ansible.builtin.debug:
msg: "Active firewall services: {{ firewall_services.stdout }}"
- name: Install DNF plugins core for managing repositories
become: true
ansible.builtin.dnf:
name: dnf-plugins-core
state: present
- name: Add Docker CE repository
become: true
ansible.builtin.yum_repository:
name: docker-ce
baseurl: https://download.docker.com/linux/fedora/docker-ce.repo
gpgcheck: false
enabled: true
description: "Docker repository"
- name: Install containerd
become: true
ansible.builtin.dnf:
name: containerd
state: present
- name: Create containerd config directory
become: true
ansible.builtin.file:
path: /etc/containerd
mode: '0755'
state: directory
- name: Generate default containerd config and enable SystemdCgroup
become: true
ansible.builtin.shell: |
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
args:
creates: /etc/containerd/config.toml
- name: Restart and enable containerd service
become: true
ansible.builtin.systemd:
name: containerd
state: restarted
enabled: true
daemon_reload: true
- name: Add Kubernetes repository
become: true
ansible.builtin.yum_repository:
name: kubernetes
description: Kubernetes
baseurl: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/
gpgkey: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key
gpgcheck: true
- name: Update dnf cache
ansible.builtin.dnf:
update_cache: true
- name: Install Kubernetes packages
become: true
ansible.builtin.dnf:
name:
- kubelet
- kubeadm
- kubectl
ansible.builtin.package:
name: "{{ item }}"
update_cache: true
state: present
disable_excludes: kubernetes
- name: Create kubelet config directory
become: true
ansible.builtin.file:
path: /var/lib/kubelet
state: directory
owner: root
group: root
mode: '0755'
- name: Create initial kubelet config file
become: true
ansible.builtin.copy:
dest: /var/lib/kubelet/config.yaml
owner: root
group: root
mode: '0644'
content: |
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
anonymous:
enabled: false
webhook:
enabled: true
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
mode: Webhook
clusterDomain: cluster.local
clusterDNS:
- 10.96.0.10
cpuManagerPolicy: none
evictionHard:
imagefs.available: 15%
memory.available: 100Mi
nodefs.available: 10%
nodefs.inodesFree: 5%
maxPods: 110
podCIDR: {{ pod_network_cidr | default('10.244.0.0/16') }}
resolvConf: /etc/resolv.conf
runtimeRequestTimeout: 2m
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
volumeStatsAggPeriod: 1m0s
- name: Install CNI plugins via dnf
become: true
ansible.builtin.dnf:
name: containernetworking-plugins
state: present
- name: Verify CNI plugins installation
become: true
ansible.builtin.command: ls -la /usr/libexec/cni/
register: cni_plugins_list
changed_when: false
- name: Display installed CNI plugins
ansible.builtin.debug:
msg: "Installed CNI plugins: {{ cni_plugins_list.stdout_lines }}"
- name: Enable and start the kubelet service
become: true
ansible.builtin.systemd:
name: kubelet
enabled: true
state: started
loop:
"{{ kubernetes_packages }}"

49
ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2 Normal file
View File

@@ -0,0 +1,49 @@
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>kubernetes_API</short>
<description>Kubernetes API</description>
<port protocol="tcp" port="6443"/>
</service>
<service>
<short>etcd</short>
<description>Kubernetes etcd</description>
<port protocol="tcp" port="2379-2380"/>
</service>
<service>
<short>kubelet</short>
<description>Kubernetes Kubelet</description>
<port protocol="tcp" port="10250"/>
</service>
<service>
<short>kube-scheduler</short>
<description>Kubernetes kube-scheduler</description>
<port protocol="tcp" port="10259"/>
</service>
<service>
<short>kube-controller-manager</short>
<description>Kubernetes kube-controller-manager</description>
<port protocol="tcp" port="10257"/>
</service>
<service>
<short>kube-proxy</short>
<description>Kubernetes kube-proxy</description>
<port protocol="tcp" port="10256"/>
</service>
<service>
<short>NodePort</short>
<description>NodePort</description>
<port protocol="tcp" port="30000-32767"/>
</service>
<service>
<short>NodePort</short>
<description>NodePort</description>
<port protocol="udp" port="30000-32767"/>
</service>

34
ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2 Normal file
View File

@@ -0,0 +1,34 @@
[kubernetes_API]
title=Kubernetes API
description=KKubernetes API
ports=6443/tcp
[etcd]
title=Kubernetes etcd
description=Kubernetes etcd
ports=2379:2380/tcp
[kubelet]
title=Kubernetes Kubelet
description=Kubernetes Kubelet
ports=10250/tcp
[kube-scheduler]
title=Kubernetes kube-scheduler
description=Kubernetes kube-scheduler
ports=10259/tcp
[kube-controller-manager]
title=Kubernetes kube-controller-manager
description=Kubernetes kube-controller-manager
ports=10257/tcp
[kube-proxy]
title=Kubernetes kube-proxy
description=Kubernetes kube-proxy
ports=10256/tcp
[NodePort]
title=NodePort
description=NodePort
ports=30000:32767/tcp|30000:32767/udp

3
ansible/playbooks/roles/kubernetes/tests/inventory Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/kubernetes/tests/test.yml Normal file
View File

@@ -0,0 +1,6 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- kubernetes

3
ansible/playbooks/roles/kubernetes/vars/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for kubernetes

5
ansible/playbooks/roles/n8n/tasks/main.yml
View File

@@ -21,11 +21,6 @@
- ca-certificates
- software-properties-common
# firewall
# sudo ufw enable
# sudo ufw allow ssh
# sudo ufw allow 5678/tcp
- name: 3. Enable UFW
become: true
community.general.ufw:

38
ansible/playbooks/roles/time-sync/README.md Normal file
View File

@@ -0,0 +1,38 @@
Role Name
=========
A brief description of the role goes here.
Requirements
------------
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
BSD
Author Information
------------------
An optional section for the role authors to include contact information, or a website (HTML is not allowed).

3
ansible/playbooks/roles/time-sync/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# defaults file for time-sync

3
ansible/playbooks/roles/time-sync/handlers/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# handlers file for time-sync

35
ansible/playbooks/roles/time-sync/meta/main.yml Normal file
View File

@@ -0,0 +1,35 @@
#SPDX-License-Identifier: MIT-0
galaxy_info:
author: your name
description: your role description
company: your company (optional)
# If the issue tracker for your role is not on github, uncomment the
# next line and provide a value
# issue_tracker_url: http://example.com/issue/tracker
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: license (GPL-2.0-or-later, MIT, etc)
min_ansible_version: 2.1
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
galaxy_tags: []
# List tags for your role here, one per line. A tag is a keyword that describes
# and categorizes the role. Users find roles by searching for tags. Be sure to
# remove the '[]' above, if you add tags to this list.
#
# NOTE: A tag is limited to a single word comprised of alphanumeric characters.
# Maximum 20 tags per role.
dependencies: []
# List your role dependencies here, one per line. Be sure to remove the '[]' above,
# if you add dependencies to this list.

41
ansible/playbooks/roles/time-sync/tasks/main.yml Normal file
View File

@@ -0,0 +1,41 @@
---
# tasks file for time-sync
- name: Manage Time Synchronization
become: true
block:
- name: Remove the ntp package
ansible.builtin.package:
name: ntp
state: absent
- name: Install the chrony package
ansible.builtin.package:
name: chrony
state: present
- name: Remove pool entries from Chrony config file
ansible.builtin.lineinfile:
path: /etc/chrony/chrony.conf
regexp: '^pool\s*'
state: absent
- name: Add local NTP servers to Chrony config file
ansible.builtin.lineinfile:
path: /etc/chrony/chrony.conf
line: "server 10.1.71.21 iburst"
state: present
- name: Start and enable chronyd
ansible.builtin.systemd:
name: chronyd
state: started
enabled: true
- name: Force time synchronization
become: true
ansible.builtin.command: chronyc makestep
register: chronyc_status
- name: Display chronyc status
ansible.builtin.debug:
var: chronyc_status.stdout

3
ansible/playbooks/roles/time-sync/tests/inventory Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
localhost

6
ansible/playbooks/roles/time-sync/tests/test.yml Normal file
View File

@@ -0,0 +1,6 @@
#SPDX-License-Identifier: MIT-0
---
- hosts: localhost
remote_user: root
roles:
- time-sync

3
ansible/playbooks/roles/time-sync/vars/main.yml Normal file
View File

@@ -0,0 +1,3 @@
#SPDX-License-Identifier: MIT-0
---
# vars file for time-sync