ansible scripts done to install kubewrnetes prequesites

ansible/group_vars/fastpass/vars

@@ -3,7 +3,7 @@
 
 # Cluster Configuration
 cluster_name: "fastpass"
-kubernetes_version: "1.33.4"
+kubernetes_version: "1.33"
 pod_network_cidr: "10.244.0.0/16"
 service_cidr: "10.96.0.0/12"
 

ansible/playbooks/roles/containerd/defaults/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# defaults file for containerd

ansible/playbooks/roles/containerd/handlers/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# handlers file for containerd

ansible/playbooks/roles/containerd/tasks/main.yml

@@ -0,0 +1,74 @@
+---
+# tasks file for containerd
+- name: Install containerd dependencies
+  become: true
+  ansible.builtin.package:
+    name: "{{ item }}"
+    state: present
+  loop:
+    "{{ containerd_dependencies }}"
+
+- name: Install via apt
+  become: true
+  when: ansible_os_family == "Debian"
+  block:
+    - name: Add repo using key from URL (apt)
+      ansible.builtin.deb822_repository:
+        name: docker
+        types: deb
+        uris: https://download.docker.com/linux/ubuntu
+        suites: "{{ ansible_distribution_release }}"
+        components: stable
+        architectures: amd64
+        signed_by: https://download.docker.com/linux/ubuntu/gpg
+
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Install via dnf
+  become: true
+  when: ansible_os_family == "RedHat"
+  block:
+    - name: Add repo using key from URL (dnf)
+      ansible.builtin.yum_repository:
+        name: docker
+        description: "Docker repository"
+        baseurl: https://download.docker.com/linux/ubuntu
+        gpgcheck: true
+        gpgkey: https://download.docker.com/linux/ubuntu/gpg
+
+    - name: Update dnf cache
+      ansible.builtin.dnf:
+        update_cache: true
+
+- name: Install containerd
+  become: true
+  ansible.builtin.package:
+    name: containerd.io
+    state: present
+
+- name: Create containerd config directory
+  ansible.builtin.file:
+    path: /etc/containerd
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Check if containerd config file exists
+  ansible.builtin.stat:
+    path: /etc/containerd/config.toml
+  register: containerd_config_file
+
+- name: Generate default containerd config and enable SystemdCgroup
+  when: containerd_config_file.stat.exists == false
+  ansible.builtin.shell: |
+    containerd config default > /etc/containerd/config.toml
+    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
+
+- name: Restart and enable containerd service
+  ansible.builtin.systemd:
+    name: containerd
+    state: restarted
+    enabled: true

ansible/playbooks/roles/containerd/tests/test.yml

@@ -0,0 +1,6 @@
+#SPDX-License-Identifier: MIT-0
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - containerd

ansible/playbooks/roles/containerd/vars/main.yml

@@ -1,3 +1,3 @@
 #SPDX-License-Identifier: MIT-0
 ---
-# tasks file for time-sync
+# vars file for containerd

ansible/playbooks/roles/kubernetes-prerequisites/defaults/main.yml

@@ -2,17 +2,11 @@
 # Kubernetes Prerequisites Role Defaults
 
 # Kubernetes version to install (should be overridden in group_vars)
-kubernetes_version: "v1.30"
+kubernetes_version: "v1.33"
-
-# Container runtime (containerd is default)
-container_runtime: "containerd"
 
 # CNI plugin to install
 cni_plugin: "calico"
 
-# Firewall configuration
-configure_firewall: true
-
 # SELinux configuration
 selinux_state: "permissive"
 
@@ -27,15 +21,14 @@ k8s_sysctl_params:
   - "net.bridge.bridge-nf-call-ip6tables: 1"
   - "net.ipv4.ip_forward: 1"
 
-# Kubernetes firewall ports
+containerd_dependencies:
-k8s_firewall_ports:
+  - curl
-  - { protocol: "tcp", port: "6443" }    # API server
+  - gnupg2
-  - { protocol: "tcp", port: "2379" }    # etcd client
+  - software-properties-common
-  - { protocol: "tcp", port: "2380" }    # etcd peer
+  - apt-transport-https
-  - { protocol: "tcp", port: "10250" }   # kubelet
+  - ca-certificates
-  - { protocol: "tcp", port: "10251" }   # kube-scheduler
+
-  - { protocol: "tcp", port: "10252" }   # kube-controller-manager
+kubernetes_packages:
-  - { protocol: "tcp", port: "10255" }   # kubelet read-only
+  - kubelet
-  - { protocol: "tcp", port: "30000-32767" }  # NodePort services
+  - kubeadm
-  - { protocol: "udp", port: "4789" }    # VXLAN (Flannel)
+  - kubectl
-  - { protocol: "tcp", port: "179" }     # BGP (Calico)

ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml

@@ -9,176 +9,71 @@
   ansible.builtin.include_role:
     name: no-swap
 
-- name: 3.1 Load required kernel modules
+- name: 3. Manage SELinux
-  become: true
-  ansible.builtin.modprobe:
-    name: "{{ item }}"
-  loop: "{{ required_kernel_modules }}"
-
-- name: 3.2 Persist kernel modules on boot
-  become: true
-  ansible.builtin.copy:
-    dest: /etc/modules-load.d/k8s.conf
-    content: "{{ required_kernel_modules | join('\n') }}"
-    owner: root
-    group: root
-    mode: '0644'
-
-- name: 3.3 Configure required sysctl params for Kubernetes
-  become: true
-  ansible.builtin.copy:
-    dest: /etc/sysctl.d/kubernetes.conf
-    content: "{{ k8s_sysctl_params | join('\n') }}"
-    owner: root
-    group: root
-    mode: '0644'
-
-- name: 3.4 Apply sysctl params without reboot
-  become: true
-  ansible.builtin.shell: sysctl --system
-
-- name: 3.5 Manage SELinux
   become: true
   when: ansible_os_family == "RedHat"
   block:
-    - name: 3.5.1 Install python3-libselinux for managing selinux
+    - name: 3.1 Install python3-libselinux for managing selinux
       ansible.builtin.dnf:
         name: python3-libselinux
         state: present
 
-    - name: 3.5.2 Set SELinux to permissive mode
+    - name: 3.2 Set SELinux to permissive mode
       ansible.posix.selinux:
         policy: targeted
         state: "{{ selinux_state }}"
 
 - name: 4 Manage Time Synchronization
+  ansible.builtin.include_role:
+    name: time-sync
+
+- name: 5.1 Manage firewall (ufw)
   become: true
+  when: ansible_os_family == "Debian"
   block:
-    - name: Check if ntp is installed
+    - name: 5.1.1 Install ufw
-      ansible.builtin.package: rpm -q ntp
-      register: ntp_installed
-      changed_when: false
-
-    - name: 4.1 Remove the ntp package
       ansible.builtin.package:
-        name: ntp
+        name: ufw
-        state: absent
-
-    - name: 4.2 Install the chrony package
-      ansible.builtin.package:
-        name: chrony
         state: present
 
+    - name: 5.1.2 Open firewall ports OpenSSH
+      community.general.ufw:
+        rule: allow
+        name: OpenSSH
 
-# - name: Start and enable chronyd
+    - name: 5.1.3 Enable ufw
-#   ansible.builtin.systemd:
+      community.general.ufw:
-#     name: chronyd
+        state: enabled
-#     state: started
-#     enabled: true
-#   when: configure_ntp | default(true)
 
-# - name: Force time synchronization
+- name: 5.2 Manage firewall (firewalld)
-#   ansible.builtin.shell: chronyc makestep
+  become: true
-#   ignore_errors: true
+  when: ansible_os_family == "RedHat"
-#   when: configure_ntp | default(true)
+  block:
+    - name: 5.2.1 Install firewalld
+      ansible.builtin.package:
+        name: firewalld
+        state: present
 
-# - name: Install firewalld
+    - name: 5.2.2 Add SSH service to default zone (ensure SSH access)
-#   ansible.builtin.dnf:
+      ansible.posix.firewalld:
-#     name: firewalld
+        service: ssh
-#     state: present
+        permanent: true
-#   when: configure_firewall | default(true)
+        immediate: true
+        state: enabled
 
-# - name: Start and enable firewalld
+    - name: 5.2.3 Start and enable firewalld
-#   ansible.builtin.systemd:
+      ansible.builtin.systemd:
-#     name: firewalld
+        name: firewalld
-#     state: started
+        state: started
-#     enabled: true
+        enabled: true
-#   when: configure_firewall | default(true)
 
-# - name: Create Kubernetes service definition
+- name: 6 Install kubernetes
-#   ansible.builtin.template:
+  ansible.builtin.include_role:
-#     dest: /etc/firewalld/services/kubernetes.xml
+    name: kubernetes
-#     owner: root
-#     group: root
-#     mode: '0644'
-#     src: kubernetes-firewall-service.xml.j2
-#   when: configure_firewall | default(true)
 
-# - name: Reload firewalld to load new service
+- name: 7 Install containerd
-#   ansible.builtin.shell: firewall-cmd --reload
+  ansible.builtin.include_role:
-#   when: configure_firewall | default(true)
+    name: containerd
-
-# - name: Add Kubernetes service to default zone
-#   ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
-#   when: configure_firewall | default(true)
-
-# - name: Add SSH service to default zone (ensure SSH access)
-#   ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
-#   when: configure_firewall | default(true)
-
-# - name: Reload firewalld to apply changes
-#   ansible.builtin.shell: firewall-cmd --reload
-#   when: configure_firewall | default(true)
-
-# - name: Verify Kubernetes service is active
-#   ansible.builtin.shell: firewall-cmd --list-services
-#   register: active_services
-#   when: configure_firewall | default(true)
-
-# - name: Display active firewall services
-#   ansible.builtin.debug:
-#     msg: "Active firewall services: {{ active_services.stdout }}"
-#   when: configure_firewall | default(true)
-
-# - name: Install DNF plugins core for managing repositories
-#   ansible.builtin.dnf:
-#     name: dnf-plugins-core
-#     state: present
-
-# - name: Add Docker CE repository
-#   ansible.builtin.shell: |
-#     curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
-
-# - name: Install containerd
-#   ansible.builtin.dnf:
-#     name: containerd
-#     state: present
-
-# - name: Create containerd config directory
-#   ansible.builtin.file:
-#     path: /etc/containerd
-#     state: directory
-#     owner: root
-#     group: root
-#     mode: '0755'
-
-# - name: Generate default containerd config and enable SystemdCgroup
-#   ansible.builtin.shell: |
-#     containerd config default > /etc/containerd/config.toml
-#     sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
-
-# - name: Restart and enable containerd service
-#   ansible.builtin.systemd:
-#     name: containerd
-#     state: restarted
-#     enabled: true
-
-# - name: Add Kubernetes repository
-#   ansible.builtin.template:
-#     dest: /etc/yum.repos.d/kubernetes.repo
-#     owner: root
-#     group: root
-#     mode: '0644'
-#     src: kubernetes.repo.j2
-
-# - name: Install Kubernetes packages
-#   ansible.builtin.dnf:
-#     name:
-#       - kubelet
-#       - kubeadm
-#       - kubectl
-#       - kubernetes-cni
-#     state: present
 
 # - name: Create kubelet config directory
 #   ansible.builtin.file:

ansible/playbooks/roles/kubernetes-prerequisites/templates/kubernetes-firewall-service.xml.j2

@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<service>
-  <short>Kubernetes</short>
-  <description>Kubernetes cluster communication ports</description>
-{% for port in k8s_firewall_ports %}
-  <port protocol="{{ port.protocol }}" port="{{ port.port }}"/>
-{% endfor %}
-</service>
-

ansible/playbooks/roles/kubernetes/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

ansible/playbooks/roles/kubernetes/defaults/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# defaults file for kubernetes

ansible/playbooks/roles/kubernetes/handlers/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# handlers file for kubernetes

ansible/playbooks/roles/kubernetes/meta/main.yml

@@ -0,0 +1,35 @@
+#SPDX-License-Identifier: MIT-0
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

ansible/playbooks/roles/kubernetes/tasks/main.yml

@@ -1,256 +1,97 @@
-# ------------------------------------------------------------------------------
+---
-# FILE: roles/common/tasks/main.yml
+# tasks file for kubernetes
-# ------------------------------------------------------------------------------
-- name: Set Kubernetes-compatible hostname
-  become: true
-  ansible.builtin.hostname:
-    name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
-  when: kubernetes_hostnames is defined
-
-- name: Remove zram-generator-defaults
-  become: true
-  ansible.builtin.dnf:
-    name: zram-generator-defaults
-    state: absent
-
-- name: Disable swap
-  ansible.builtin.command: swapoff -a
-  become: true
-  changed_when: false
-
-- name: Persist swap off by commenting out swap in fstab
-  become: true
-  ansible.builtin.replace:
-    path: /etc/fstab
-    regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
-    replace: '#\2'
-    backup: true
-
 - name: Load required kernel modules
   become: true
   community.general.modprobe:
     name: "{{ item }}"
-    state: present
+  loop: "{{ required_kernel_modules }}"
-  loop:
-    - overlay
-    - br_netfilter
 
 - name: Persist kernel modules on boot
   become: true
   ansible.builtin.copy:
     dest: /etc/modules-load.d/k8s.conf
+    content: "{{ required_kernel_modules | join('\n') }}"
+    owner: root
+    group: root
     mode: '0644'
-    content: |
-      overlay
-      br_netfilter
 
 - name: Configure required sysctl params for Kubernetes
   become: true
   ansible.builtin.copy:
-    dest: /etc/sysctl.d/k8s.conf
+    dest: /etc/sysctl.d/kubernetes.conf
+    content: "{{ k8s_sysctl_params | join('\n') }}"
+    owner: root
+    group: root
     mode: '0644'
-    content: |
-      net.bridge.bridge-nf-call-iptables  = 1
-      net.bridge.bridge-nf-call-ip6tables = 1
-      net.ipv4.ip_forward                 = 1
 
 - name: Apply sysctl params without reboot
   become: true
   ansible.builtin.command: sysctl --system
-  changed_when: false
 
-- name: Install python3-libselinux for managing selinux
+- name: Manage firewall (ufw)
   become: true
-  ansible.builtin.dnf:
+  when: ansible_os_family == "Debian"
-    name: python3-libselinux
+  block:
-    state: present
+    - name: Create Kubernetes service definition (ufw)
+      ansible.builtin.template:
+        dest: /etc/ufw/applications.d/kubernetes
+        owner: root
+        group: root
+        mode: '0644'
+        src: kubernetes-ufw-service.xml.j2
 
-- name: Set SELinux to permissive mode
+- name: Manage firewall (firewalld)
   become: true
-  ansible.posix.selinux:
+  when: ansible_os_family == "RedHat"
-    policy: targeted
+  block:
-    state: permissive
+    - name: Create Kubernetes service definition (firewalld)
+      ansible.builtin.template:
+        dest: /etc/firewalld/services/kubernetes.xml
+        owner: root
+        group: root
+        mode: '0644'
+        src: kubernetes-firewalld-service.xml.j2
 
-- name: Create Kubernetes service definition
+- name: Install via apt
   become: true
-  ansible.builtin.copy:
+  when: ansible_os_family == "Debian"
-    dest: /etc/firewalld/services/kubernetes.xml
+  block:
-    owner: root
+    - name: Add Kubernetes apt key
-    group: root
+      ansible.builtin.apt_key:
-    mode: '0644'
+        url: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version }}/deb/Release.key"
-    content: |
+        state: present
-      <?xml version="1.0" encoding="utf-8"?>
-      <service>
-        <short>Kubernetes</short>
-        <description>Kubernetes cluster communication ports</description>
-        <port protocol="tcp" port="6443"/>
-        <port protocol="tcp" port="2379"/>
-        <port protocol="tcp" port="2380"/>
-        <port protocol="tcp" port="10250"/>
-        <port protocol="tcp" port="10251"/>
-        <port protocol="tcp" port="10252"/>
-        <port protocol="tcp" port="10255"/>
-        <port protocol="tcp" port="30000-32767"/>
-        <port protocol="udp" port="4789"/>
-        <port protocol="tcp" port="179"/>
-      </service>
 
-- name: Reload firewalld to load new service
+    - name: Add Kubernetes repository
+      ansible.builtin.apt_repository:
+        repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /"
+        state: present
+        filename: kubernetes
+
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+
+- name: Install via dnf (may not work)
   become: true
-  ansible.builtin.command: firewall-cmd --reload
+  when: ansible_os_family == "RedHat"
+  block:
+    - name: Add repo using key from URL (dnf)
+      ansible.builtin.yum_repository:
+        name: kubernetes
+        description: "Kubernetes repository"
+        baseurl: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/
+        gpgcheck: true
+        gpgkey: https://pkgs.k8s.io/core:/stable:/{{ kubernetes_version }}/rpm/repodata/repomd.xml.key
 
-- name: Add Kubernetes service to default zone
+    - name: Update dnf cache
-  become: true
+      ansible.builtin.dnf:
-  ansible.builtin.command: firewall-cmd --permanent --add-service=kubernetes
+        update_cache: true
-
-- name: Add SSH service to default zone (ensure SSH access)
-  become: true
-  ansible.builtin.command: firewall-cmd --permanent --add-service=ssh
-
-- name: Reload firewalld to apply changes
-  become: true
-  ansible.builtin.command: firewall-cmd --reload
-
-- name: Verify Kubernetes service is active
-  become: true
-  ansible.builtin.command: firewall-cmd --list-services
-  register: firewall_services
-  changed_when: false
-
-- name: Display active firewall services
-  ansible.builtin.debug:
-    msg: "Active firewall services: {{ firewall_services.stdout }}"
-
-- name: Install DNF plugins core for managing repositories
-  become: true
-  ansible.builtin.dnf:
-    name: dnf-plugins-core
-    state: present
-
-- name: Add Docker CE repository
-  become: true
-  ansible.builtin.yum_repository:
-    name: docker-ce
-    baseurl: https://download.docker.com/linux/fedora/docker-ce.repo
-    gpgcheck: false
-    enabled: true
-    description: "Docker repository"
-
-- name: Install containerd
-  become: true
-  ansible.builtin.dnf:
-    name: containerd
-    state: present
-
-- name: Create containerd config directory
-  become: true
-  ansible.builtin.file:
-    path: /etc/containerd
-    mode: '0755'
-    state: directory
-
-- name: Generate default containerd config and enable SystemdCgroup
-  become: true
-  ansible.builtin.shell: |
-    containerd config default > /etc/containerd/config.toml
-    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
-  args:
-    creates: /etc/containerd/config.toml
-
-- name: Restart and enable containerd service
-  become: true
-  ansible.builtin.systemd:
-    name: containerd
-    state: restarted
-    enabled: true
-    daemon_reload: true
-
-- name: Add Kubernetes repository
-  become: true
-  ansible.builtin.yum_repository:
-    name: kubernetes
-    description: Kubernetes
-    baseurl: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/
-    gpgkey: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key
-    gpgcheck: true
 
 - name: Install Kubernetes packages
   become: true
-  ansible.builtin.dnf:
+  ansible.builtin.package:
-    name:
+    name: "{{ item }}"
-      - kubelet
+    update_cache: true
-      - kubeadm
-      - kubectl
     state: present
-    disable_excludes: kubernetes
+  loop:
-
+    "{{ kubernetes_packages }}"
-- name: Create kubelet config directory
-  become: true
-  ansible.builtin.file:
-    path: /var/lib/kubelet
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-
-- name: Create initial kubelet config file
-  become: true
-  ansible.builtin.copy:
-    dest: /var/lib/kubelet/config.yaml
-    owner: root
-    group: root
-    mode: '0644'
-    content: |
-      apiVersion: kubelet.config.k8s.io/v1beta1
-      kind: KubeletConfiguration
-      authentication:
-        anonymous:
-          enabled: false
-        webhook:
-          enabled: true
-        x509:
-          clientCAFile: /etc/kubernetes/pki/ca.crt
-      authorization:
-        mode: Webhook
-      clusterDomain: cluster.local
-      clusterDNS:
-        - 10.96.0.10
-      cpuManagerPolicy: none
-      evictionHard:
-        imagefs.available: 15%
-        memory.available: 100Mi
-        nodefs.available: 10%
-        nodefs.inodesFree: 5%
-      maxPods: 110
-      podCIDR: {{ pod_network_cidr | default('10.244.0.0/16') }}
-      resolvConf: /etc/resolv.conf
-      runtimeRequestTimeout: 2m
-      staticPodPath: /etc/kubernetes/manifests
-      streamingConnectionIdleTimeout: 4h0m0s
-      syncFrequency: 1m0s
-      volumeStatsAggPeriod: 1m0s
-
-- name: Install CNI plugins via dnf
-  become: true
-  ansible.builtin.dnf:
-    name: containernetworking-plugins
-    state: present
-
-- name: Verify CNI plugins installation
-  become: true
-  ansible.builtin.command: ls -la /usr/libexec/cni/
-  register: cni_plugins_list
-  changed_when: false
-
-
-
-- name: Display installed CNI plugins
-  ansible.builtin.debug:
-    msg: "Installed CNI plugins: {{ cni_plugins_list.stdout_lines }}"
-
-- name: Enable and start the kubelet service
-  become: true
-  ansible.builtin.systemd:
-    name: kubelet
-    enabled: true
-    state: started

ansible/playbooks/roles/kubernetes/templates/kubernetes-firewalld-service.xml.j2

@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<service>
+  <short>kubernetes_API</short>
+  <description>Kubernetes API</description>
+  <port protocol="tcp" port="6443"/>
+</service>
+
+<service>
+  <short>etcd</short>
+  <description>Kubernetes etcd</description>
+  <port protocol="tcp" port="2379-2380"/>
+</service>
+
+<service>
+  <short>kubelet</short>
+  <description>Kubernetes Kubelet</description>
+  <port protocol="tcp" port="10250"/>
+</service>
+
+<service>
+  <short>kube-scheduler</short>
+  <description>Kubernetes kube-scheduler</description>
+  <port protocol="tcp" port="10259"/>
+</service>
+
+<service>
+  <short>kube-controller-manager</short>
+  <description>Kubernetes kube-controller-manager</description>
+  <port protocol="tcp" port="10257"/>
+</service>
+
+<service>
+  <short>kube-proxy</short>
+  <description>Kubernetes kube-proxy</description>
+  <port protocol="tcp" port="10256"/>
+</service>
+
+<service>
+  <short>NodePort</short>
+  <description>NodePort</description>
+  <port protocol="tcp" port="30000-32767"/>
+</service>
+
+<service>
+  <short>NodePort</short>
+  <description>NodePort</description>
+  <port protocol="udp" port="30000-32767"/>
+</service>

ansible/playbooks/roles/kubernetes/templates/kubernetes-ufw-service.xml.j2

@@ -0,0 +1,34 @@
+[kubernetes_API]
+title=Kubernetes API
+description=KKubernetes API
+ports=6443/tcp
+
+[etcd]
+title=Kubernetes etcd
+description=Kubernetes etcd
+ports=2379:2380/tcp
+
+[kubelet]
+title=Kubernetes Kubelet
+description=Kubernetes Kubelet
+ports=10250/tcp
+
+[kube-scheduler]
+title=Kubernetes kube-scheduler
+description=Kubernetes kube-scheduler
+ports=10259/tcp
+
+[kube-controller-manager]
+title=Kubernetes kube-controller-manager
+description=Kubernetes kube-controller-manager
+ports=10257/tcp
+
+[kube-proxy]
+title=Kubernetes kube-proxy
+description=Kubernetes kube-proxy
+ports=10256/tcp
+
+[NodePort]
+title=NodePort
+description=NodePort
+ports=30000:32767/tcp|30000:32767/udp

ansible/playbooks/roles/kubernetes/tests/inventory

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+localhost
+

ansible/playbooks/roles/kubernetes/tests/test.yml

@@ -0,0 +1,6 @@
+#SPDX-License-Identifier: MIT-0
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - kubernetes

ansible/playbooks/roles/kubernetes/vars/main.yml

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+---
+# vars file for kubernetes

ansible/playbooks/roles/n8n/tasks/main.yml

@@ -21,11 +21,6 @@
     - ca-certificates
     - software-properties-common
 
-# firewall
-# sudo ufw enable
-# sudo ufw allow ssh
-# sudo ufw allow 5678/tcp
-
 - name: 3. Enable UFW
   become: true
   community.general.ufw:

ansible/playbooks/roles/time-sync/README.md

@@ -0,0 +1,38 @@
+Role Name
+=========
+
+A brief description of the role goes here.
+
+Requirements
+------------
+
+Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+
+Role Variables
+--------------
+
+A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+
+Dependencies
+------------
+
+A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+
+Example Playbook
+----------------
+
+Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+
+    - hosts: servers
+      roles:
+         - { role: username.rolename, x: 42 }
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+An optional section for the role authors to include contact information, or a website (HTML is not allowed).

ansible/playbooks/roles/time-sync/meta/main.yml

@@ -0,0 +1,35 @@
+#SPDX-License-Identifier: MIT-0
+galaxy_info:
+  author: your name
+  description: your role description
+  company: your company (optional)
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license (GPL-2.0-or-later, MIT, etc)
+
+  min_ansible_version: 2.1
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.

ansible/playbooks/roles/time-sync/tasks/main.yml

@@ -0,0 +1,41 @@
+---
+# tasks file for time-sync
+- name: Manage Time Synchronization
+  become: true
+  block:
+    - name: Remove the ntp package
+      ansible.builtin.package:
+        name: ntp
+        state: absent
+
+    - name: Install the chrony package
+      ansible.builtin.package:
+        name: chrony
+        state: present
+
+    - name: Remove pool entries from Chrony config file
+      ansible.builtin.lineinfile:
+        path: /etc/chrony/chrony.conf
+        regexp: '^pool\s*'
+        state: absent
+
+    - name: Add local NTP servers to Chrony config file
+      ansible.builtin.lineinfile:
+        path: /etc/chrony/chrony.conf
+        line: "server 10.1.71.21 iburst"
+        state: present
+
+    - name: Start and enable chronyd
+      ansible.builtin.systemd:
+        name: chronyd
+        state: started
+        enabled: true
+
+    - name: Force time synchronization
+      become: true
+      ansible.builtin.command: chronyc makestep
+      register: chronyc_status
+
+    - name: Display chronyc status
+      ansible.builtin.debug:
+        var: chronyc_status.stdout

ansible/playbooks/roles/time-sync/tests/inventory

@@ -0,0 +1,3 @@
+#SPDX-License-Identifier: MIT-0
+localhost
+