From a642d2382d513b49181bb557395a2637f2597370 Mon Sep 17 00:00:00 2001
From: rblundon <ryan.blundon@protonmail.com>
Date: Tue, 19 Aug 2025 17:06:29 -0500
Subject: [PATCH] start ansible scripts

---
 ansible/playbooks/deploy_k8s.yml              |  14 +++
 ansible/roles/common/tasks/main.yml           | 101 ++++++++++++++++++
 ansible/roles/control-plane/tasks/main.yml    |  59 ++++++++++
 .../nmstate/overlays/internal/iscsi-nad.yaml  |   4 +-
 4 files changed, 176 insertions(+), 2 deletions(-)
 create mode 100644 ansible/playbooks/deploy_k8s.yml
 create mode 100644 ansible/roles/common/tasks/main.yml
 create mode 100644 ansible/roles/control-plane/tasks/main.yml

diff --git a/ansible/playbooks/deploy_k8s.yml b/ansible/playbooks/deploy_k8s.yml
new file mode 100644
index 0000000..ed072a4
--- /dev/null
+++ b/ansible/playbooks/deploy_k8s.yml
@@ -0,0 +1,14 @@
+- name: 1. Prepare all nodes for Kubernetes
+  hosts: kube_cluster
+  roles:
+    - role: common
+
+- name: 2. Initialize and configure the control plane
+  hosts: control_plane
+  roles:
+    - role: control-plane
+
+- name: 3. Join worker nodes to the cluster
+  hosts: workers
+  roles:
+    - role: workers
\ No newline at end of file
diff --git a/ansible/roles/common/tasks/main.yml b/ansible/roles/common/tasks/main.yml
new file mode 100644
index 0000000..ec96dd3
--- /dev/null
+++ b/ansible/roles/common/tasks/main.yml
@@ -0,0 +1,101 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/common/tasks/main.yml
+# ------------------------------------------------------------------------------
+- name: Disable swap
+  command: swapoff -a
+  changed_when: false
+
+- name: Persist swap off by commenting out swap in fstab
+  replace:
+    path: /etc/fstab
+    regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
+    replace: '#\2'
+    backup: yes
+
+- name: Load required kernel modules
+  modprobe:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - overlay
+    - br_netfilter
+
+- name: Persist kernel modules on boot
+  copy:
+    dest: /etc/modules-load.d/k8s.conf
+    content: |
+      overlay
+      br_netfilter
+
+- name: Configure required sysctl params for Kubernetes
+  copy:
+    dest: /etc/sysctl.d/k8s.conf
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+
+- name: Apply sysctl params without reboot
+  command: sysctl --system
+  changed_when: false
+
+- name: Set SELinux to permissive mode
+  selinux:
+    policy: targeted
+    state: permissive
+
+- name: Install DNF plugins core for managing repositories
+  dnf:
+    name: dnf-plugins-core
+    state: present
+
+- name: Add Docker CE repository
+  command: dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
+  args:
+    creates: /etc/yum.repos.d/docker-ce.repo
+
+- name: Install containerd
+  dnf:
+    name: containerd.io
+    state: present
+
+- name: Create containerd config directory
+  file:
+    path: /etc/containerd
+    state: directory
+
+- name: Generate default containerd config and enable SystemdCgroup
+  shell: |
+    containerd config default > /etc/containerd/config.toml
+    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
+  args:
+    creates: /etc/containerd/config.toml
+
+- name: Restart and enable containerd service
+  systemd:
+    name: containerd
+    state: restarted
+    enabled: yes
+    daemon_reload: yes
+
+- name: Add Kubernetes repository
+  yum_repository:
+    name: kubernetes
+    description: Kubernetes
+    baseurl: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/
+    gpgkey: https://pkgs.k8s.io/core:/stable:/v1.33/rpm/repodata/repomd.xml.key
+    gpgcheck: yes
+
+- name: Install Kubernetes packages
+  dnf:
+    name:
+      - kubelet
+      - kubeadm
+      - kubectl
+    state: present
+    disable_excludes: kubernetes
+
+- name: Enable the kubelet service
+  systemd:
+    name: kubelet
+    enabled: yes
\ No newline at end of file
diff --git a/ansible/roles/control-plane/tasks/main.yml b/ansible/roles/control-plane/tasks/main.yml
new file mode 100644
index 0000000..4b949c2
--- /dev/null
+++ b/ansible/roles/control-plane/tasks/main.yml
@@ -0,0 +1,59 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/control-plane/tasks/main.yml
+# ------------------------------------------------------------------------------
+- name: Check if cluster is already initialized
+  stat:
+    path: /etc/kubernetes/admin.conf
+  register: kube_init_stat
+
+- name: Initialize the Kubernetes cluster
+  when: not kube_init_stat.stat.exists
+  command: >
+    kubeadm init
+    --pod-network-cidr=10.244.0.0/16
+    --control-plane-endpoint={{ inventory_hostname }}
+  register: kubeadm_init
+
+- name: Create .kube directory for the user
+  become: no
+  file:
+    path: "{{ ansible_env.HOME }}/.kube"
+    state: directory
+    mode: '0755'
+  delegate_to: localhost
+  run_once: true
+
+- name: Copy admin.conf to user's .kube directory on controller
+  when: not kube_init_stat.stat.exists
+  fetch:
+    src: /etc/kubernetes/admin.conf
+    dest: "{{ ansible_env.HOME }}/.kube/config"
+    flat: yes
+
+- name: Install Calico CNI
+  become: no
+  command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/calico.yaml
+  delegate_to: localhost
+  run_once: true
+  when: not kube_init_stat.stat.exists
+
+- name: Generate join command for control plane nodes
+  when: not kube_init_stat.stat.exists
+  command: kubeadm token create --print-join-command
+  register: control_plane_join_command_raw
+
+- name: Generate certificate key for control plane join
+  when: not kube_init_stat.stat.exists
+  command: kubeadm init phase upload-certs --upload-certs
+  register: control_plane_cert_key
+
+- name: Store control plane join command
+  set_fact:
+    control_plane_join_command: "{{ control_plane_join_command_raw.stdout }} --control-plane --certificate-key {{ control_plane_cert_key.stdout_lines[-1] }}"
+  when: not kube_init_stat.stat.exists
+
+- name: Join other control plane nodes to the cluster
+  when:
+    - inventory_hostname != groups['control_plane'][0]
+    - not kube_init_stat.stat.exists
+  command: "{{ hostvars[groups['control_plane'][0]].control_plane_join_command }}"
diff --git a/cluster/nmstate/overlays/internal/iscsi-nad.yaml b/cluster/nmstate/overlays/internal/iscsi-nad.yaml
index 913259d..a7ce418 100644
--- a/cluster/nmstate/overlays/internal/iscsi-nad.yaml
+++ b/cluster/nmstate/overlays/internal/iscsi-nad.yaml
@@ -12,8 +12,8 @@ spec:
       "name": "iscsi-net",
       "cniVersion": "0.3.1",
       "type": "vlan",
-      "master": "enp1s0f0",
-      "mtu": 1500,
+      "master": "enp2s0f0",
+      "mtu": 1500, 
       "vlanId": 121,
       "linkInContainer": false,
       "ipam": {