Sync before Archive

git-subtree-dir: acm-hub-bootstrap
git-subtree-split: 4b79b1a0be6da2a9efc9ace8871b4762342da70b

.gitignore

@@ -32,6 +32,7 @@ Temporary Items
 *.icloud
 
 # Terraform
+terraform/
 .terraform/
 *.tfstate
 *.tfstate.backup
@@ -46,3 +47,6 @@ crash.log
 # Ignore CLI configuration files
 .terraformrc
 .terraformrc.json
+
+# Ignore secrets
+doppler-token.yaml

.kiro/specs/applescript-calendar-sync/design.md

@@ -0,0 +1,209 @@
+# Design Document
+
+## Overview
+
+The AppleScript Calendar Sync system is designed as a standalone AppleScript application that synchronizes calendar events between two calendar accounts for the current day only. The system uses macOS Calendar app's AppleScript interface to read events from a source calendar and mirror them to a destination calendar, including removal of events that no longer exist in the source.
+
+## Architecture
+
+The system follows a simple pipeline architecture:
+
+```
+[Source Calendar] → [Event Reader] → [Event Processor] → [Destination Calendar]
+                                          ↓
+                                   [Duplicate Detector]
+                                          ↓
+                                   [Cleanup Manager]
+```
+
+### Core Components
+
+1. **Calendar Manager**: Handles calendar account and calendar selection/validation
+2. **Event Reader**: Retrieves events from source calendar for current day
+3. **Event Processor**: Processes and transforms events for destination calendar
+4. **Sync Engine**: Coordinates the synchronization process including cleanup
+5. **Logger**: Provides user feedback and error reporting
+
+## Components and Interfaces
+
+### Calendar Manager
+```applescript
+-- Validates and retrieves calendar references
+on getCalendar(accountName, calendarName)
+on validateCalendarAccess(calendar)
+on listAvailableCalendars()
+```
+
+**Responsibilities:**
+- Validate calendar account and calendar names exist
+- Return calendar object references for AppleScript operations
+- Handle calendar access permissions and errors
+
+### Event Reader
+```applescript
+-- Reads events from source calendar for current day
+on getEventsForToday(sourceCalendar)
+on parseEventProperties(event)
+```
+
+**Responsibilities:**
+- Query source calendar for events occurring on current date
+- Extract event properties (title, start time, end time, description, etc.)
+- Handle different event types (all-day, timed, recurring)
+
+### Event Processor
+```applescript
+-- Processes events for destination calendar
+on createEventInDestination(eventData, destinationCalendar)
+on updateExistingEvent(existingEvent, newEventData)
+on compareEvents(event1, event2)
+```
+
+**Responsibilities:**
+- Create new events in destination calendar
+- Update modified events
+- Compare events for duplicate detection
+
+### Sync Engine
+```applescript
+-- Main synchronization coordinator
+on performSync(sourceCalendar, destinationCalendar)
+on cleanupRemovedEvents(sourceEvents, destinationEvents, destinationCalendar)
+on generateSyncReport(results)
+```
+
+**Responsibilities:**
+- Coordinate the entire sync process
+- Manage event cleanup (removal of events not in source)
+- Generate sync reports and statistics
+
+### Logger
+```applescript
+-- Logging and user feedback
+on logMessage(message, level)
+on displayProgress(current, total)
+on showSyncSummary(summary)
+```
+
+**Responsibilities:**
+- Display progress information to user
+- Log errors and warnings
+- Show final sync summary
+
+## Data Models
+
+### Event Data Structure
+```applescript
+record EventData
+    title: string
+    startDate: date
+    endDate: date
+    isAllDay: boolean
+    description: string
+    location: string
+    uid: string (for duplicate detection)
+end record
+```
+
+### Sync Result Structure
+```applescript
+record SyncResult
+    eventsCreated: integer
+    eventsUpdated: integer
+    eventsRemoved: integer
+    eventsSkipped: integer
+    errors: list of strings
+end record
+```
+
+## Error Handling
+
+### Error Categories
+1. **Calendar Access Errors**: Invalid calendar names, permission issues
+2. **Event Processing Errors**: Malformed events, property access failures
+3. **Sync Operation Errors**: Network issues, calendar service unavailable
+
+### Error Handling Strategy
+- Graceful degradation: Continue processing other events when individual events fail
+- Detailed error logging with specific error messages
+- User-friendly error reporting with suggested solutions
+- Rollback capability for critical failures
+
+### Error Recovery
+```applescript
+on handleCalendarError(errorMessage)
+    -- Log error details
+    -- Provide user-friendly error message
+    -- Suggest corrective actions
+end handleCalendarError
+```
+
+## Testing Strategy
+
+### Unit Testing Approach
+Since AppleScript has limited testing frameworks, testing will focus on:
+
+1. **Manual Testing Scenarios**:
+   - Test with empty source calendar
+   - Test with events spanning multiple days
+   - Test with all-day events
+   - Test with recurring events
+   - Test calendar access errors
+
+2. **Integration Testing**:
+   - Test full sync workflow with real calendar data
+   - Test cleanup functionality (event removal)
+   - Test duplicate detection accuracy
+   - Test error handling with invalid inputs
+
+3. **Edge Case Testing**:
+   - Very long event titles and descriptions
+   - Events with special characters
+   - Overlapping events
+   - Events created/modified during sync
+
+### Test Data Requirements
+- Test calendars with known event sets
+- Events with various properties (all-day, timed, recurring)
+- Events with special characters and long descriptions
+- Calendar accounts with different permission levels
+
+## Implementation Considerations
+
+### AppleScript Calendar Integration
+- Use `Calendar` application's AppleScript dictionary
+- Handle calendar app launch and focus management
+- Manage calendar selection and event creation timing
+
+### Performance Optimization
+- Batch event operations where possible
+- Minimize calendar app UI interactions
+- Cache calendar references to avoid repeated lookups
+
+### User Experience
+- Provide clear progress indicators
+- Show meaningful error messages
+- Allow user to cancel long-running operations
+- Display comprehensive sync results
+
+### Security and Privacy
+- Request calendar access permissions appropriately
+- Handle sensitive calendar data securely
+- Provide clear information about what data is accessed
+
+## Configuration Management
+
+### User Configuration
+```applescript
+-- Configuration properties
+property sourceAccountName : "Work Account"
+property sourceCalendarName : "Main Calendar"
+property destinationAccountName : "Personal Account"
+property destinationCalendarName : "Synced Events"
+property enableLogging : true
+```
+
+### Runtime Configuration
+- Allow users to modify calendar names without editing script
+- Provide configuration validation before sync starts
+- Save user preferences for repeated use

.kiro/specs/applescript-calendar-sync/requirements.md

@@ -0,0 +1,73 @@
+# Requirements Document
+
+## Introduction
+
+This feature enables automatic synchronization of calendar entries between two different calendar accounts using AppleScript. The system will copy events from a source calendar account to a destination calendar account, maintaining event details while avoiding duplicates and providing configurable sync options.
+
+## Requirements
+
+### Requirement 1
+
+**User Story:** As a user with multiple calendar accounts, I want to sync events from one account to another, so that I can maintain consistent scheduling across different calendar systems.
+
+#### Acceptance Criteria
+
+1. WHEN the sync script is executed THEN the system SHALL read all events from the specified source calendar
+2. WHEN events are found in the source calendar THEN the system SHALL copy them to the specified destination calendar
+3. WHEN copying events THEN the system SHALL preserve event title, date, time, duration, and description
+4. IF an event already exists in the destination calendar THEN the system SHALL skip creating a duplicate
+
+### Requirement 2
+
+**User Story:** As a user, I want to configure which calendars to sync between, so that I can control the data flow between my accounts.
+
+#### Acceptance Criteria
+
+1. WHEN configuring the sync THEN the system SHALL allow selection of source calendar account and specific calendar
+2. WHEN configuring the sync THEN the system SHALL allow selection of destination calendar account and specific calendar
+3. WHEN invalid calendar names are provided THEN the system SHALL display an error message and exit gracefully
+4. WHEN calendar accounts are not accessible THEN the system SHALL provide clear error messaging
+
+### Requirement 3
+
+**User Story:** As a user, I want the sync to focus on today's events only, so that I maintain current day synchronization without overwhelming the destination calendar.
+
+#### Acceptance Criteria
+
+1. WHEN the sync runs THEN the system SHALL only process events occurring on the current day
+2. WHEN determining current day THEN the system SHALL use the local system date
+3. WHEN events span multiple days THEN the system SHALL include events that start or occur on the current day
+4. WHEN no events exist for the current day THEN the system SHALL complete successfully with appropriate messaging
+
+### Requirement 4
+
+**User Story:** As a user, I want the destination calendar to mirror the source calendar for the current day, so that removed events are also cleaned up automatically.
+
+#### Acceptance Criteria
+
+1. WHEN checking for duplicates THEN the system SHALL compare event title, start date, and start time
+2. WHEN a matching event is found in the destination THEN the system SHALL skip creating the duplicate
+3. WHEN an event exists in the destination but not in the source for the current day THEN the system SHALL remove it from the destination
+4. WHEN an event has been modified in the source THEN the system SHALL update the corresponding event in the destination
+
+### Requirement 5
+
+**User Story:** As a user, I want to see progress and results of the sync operation, so that I can verify the synchronization was successful.
+
+#### Acceptance Criteria
+
+1. WHEN the sync starts THEN the system SHALL display the source and destination calendar information
+2. WHEN processing events THEN the system SHALL show progress indicators for each event processed
+3. WHEN the sync completes THEN the system SHALL display a summary of events copied, skipped, and any errors
+4. WHEN errors occur THEN the system SHALL log detailed error information for troubleshooting
+
+### Requirement 6
+
+**User Story:** As a user, I want the sync to handle different event types and properties, so that all my calendar data is accurately transferred.
+
+#### Acceptance Criteria
+
+1. WHEN syncing events THEN the system SHALL handle all-day events correctly
+2. WHEN syncing events THEN the system SHALL preserve recurring event patterns when possible
+3. WHEN syncing events THEN the system SHALL handle events with attendees and meeting details
+4. WHEN event properties cannot be transferred THEN the system SHALL log which properties were skipped

.kiro/specs/applescript-calendar-sync/tasks.md

@@ -0,0 +1,125 @@
+# Implementation Plan
+
+- [x] 1. Set up project structure and configuration
+  - Create main AppleScript file with basic structure and configuration properties
+  - Define configuration properties for source and destination calendars
+  - Set up logging and error handling framework
+  - _Requirements: 2.1, 2.2, 5.1_
+
+- [ ] 2. Implement Calendar Manager component
+  - [ ] 2.1 Create calendar validation and access functions
+    - Write functions to validate calendar account and calendar names exist
+    - Implement calendar object retrieval with error handling
+    - Create function to list available calendars for debugging
+    - _Requirements: 2.1, 2.2, 2.3, 2.4_
+
+  - [ ]* 2.2 Write unit tests for calendar access
+    - Create test scenarios for invalid calendar names
+    - Test calendar access permission handling
+    - _Requirements: 2.3, 2.4_
+
+- [ ] 3. Implement Event Reader component
+  - [ ] 3.1 Create current day event retrieval function
+    - Write function to get today's date and create date range
+    - Implement event query for current day from source calendar
+    - Handle different event types (all-day, timed events)
+    - _Requirements: 1.1, 3.1, 3.2, 3.3_
+
+  - [ ] 3.2 Implement event property extraction
+    - Create function to extract event title, dates, description, location
+    - Handle event property access errors gracefully
+    - Parse recurring events for current day occurrences
+    - _Requirements: 1.3, 6.1, 6.2, 6.3_
+
+  - [ ]* 3.3 Write tests for event reading functionality
+    - Test event retrieval with various event types
+    - Test property extraction accuracy
+    - _Requirements: 1.1, 1.3_
+
+- [ ] 4. Implement Event Processor component
+  - [ ] 4.1 Create event comparison and duplicate detection
+    - Write function to compare events by title, start date, and start time
+    - Implement duplicate detection logic for existing events
+    - Handle event matching edge cases
+    - _Requirements: 4.1, 4.2_
+
+  - [ ] 4.2 Implement event creation and update functions
+    - Create function to add new events to destination calendar
+    - Implement event update functionality for modified events
+    - Handle event creation errors and property limitations
+    - _Requirements: 1.2, 1.3, 4.4, 6.4_
+
+  - [ ]* 4.3 Write tests for event processing
+    - Test duplicate detection accuracy
+    - Test event creation with various properties
+    - _Requirements: 4.1, 4.2, 4.4_
+
+- [ ] 5. Implement Sync Engine component
+  - [ ] 5.1 Create main synchronization workflow
+    - Implement the main sync function that coordinates all components
+    - Add progress tracking and user feedback during sync
+    - Handle sync workflow errors and recovery
+    - _Requirements: 1.1, 1.2, 5.2, 5.3_
+
+  - [ ] 5.2 Implement cleanup functionality for removed events
+    - Create function to identify events in destination not in source
+    - Implement event removal from destination calendar
+    - Add safety checks to prevent accidental deletions
+    - _Requirements: 4.3_
+
+  - [ ] 5.3 Create sync reporting and statistics
+    - Implement sync result tracking (created, updated, removed, skipped)
+    - Create summary display function with detailed results
+    - Add error reporting and logging
+    - _Requirements: 5.3, 5.4_
+
+  - [ ]* 5.4 Write integration tests for sync engine
+    - Test complete sync workflow with test data
+    - Test cleanup functionality accuracy
+    - Test error handling and recovery
+    - _Requirements: 4.3, 5.3_
+
+- [ ] 6. Implement Logger component
+  - [ ] 6.1 Create logging and progress display functions
+    - Implement message logging with different severity levels
+    - Create progress indicator for sync operations
+    - Add user-friendly error message formatting
+    - _Requirements: 5.1, 5.2, 5.4_
+
+  - [ ] 6.2 Implement sync summary display
+    - Create formatted summary of sync results
+    - Display statistics for events processed
+    - Show any errors or warnings encountered
+    - _Requirements: 5.3, 5.4_
+
+- [ ] 7. Integrate all components and create main script
+  - [ ] 7.1 Wire together all components in main execution flow
+    - Create main script entry point that calls all components
+    - Implement proper error handling and user feedback flow
+    - Add configuration validation before sync starts
+    - _Requirements: 2.3, 2.4, 5.1_
+
+  - [ ] 7.2 Add user interaction and configuration management
+    - Implement user prompts for calendar selection if needed
+    - Add configuration validation and error messaging
+    - Create user-friendly script execution experience
+    - _Requirements: 2.1, 2.2, 2.3, 2.4_
+
+  - [ ]* 7.3 Create comprehensive end-to-end tests
+    - Test complete sync workflow with real calendar data
+    - Test all error scenarios and edge cases
+    - Validate sync accuracy and cleanup functionality
+    - _Requirements: 1.1, 1.2, 4.3, 5.3_
+
+- [ ] 8. Finalize and optimize the script
+  - [ ] 8.1 Add performance optimizations and error recovery
+    - Optimize calendar access and event processing performance
+    - Add robust error recovery and rollback capabilities
+    - Implement proper resource cleanup and calendar app management
+    - _Requirements: 5.4_
+
+  - [ ] 8.2 Create user documentation and usage instructions
+    - Write clear instructions for script configuration and usage
+    - Document calendar permission requirements
+    - Create troubleshooting guide for common issues
+    - _Requirements: 2.3, 2.4, 5.4_

.kiro/specs/fastpass-additional-control-plane/design.md

@@ -0,0 +1,165 @@
+# Design Document
+
+## Overview
+
+The `fastpass-additional-control-plane` Ansible role will enable the deployment of additional control plane nodes to an existing FastPass Kubernetes cluster. This role follows the established patterns from `fastpass-first-control-plane` but focuses on joining nodes to an already initialized cluster rather than initializing a new one. The role ensures high availability by creating redundant master nodes that can handle API requests, scheduling, and cluster management tasks.
+
+The key difference from the first control plane role is that this role will use `kubeadm join` with control plane flags instead of `kubeadm init`, and it will need to retrieve join tokens and certificate keys from the existing cluster.
+
+## Architecture
+
+### Role Structure
+The role will follow the standard Ansible role structure:
+```
+ansible/playbooks/roles/fastpass-additional-control-plane/
+├── defaults/
+│   └── main.yml
+├── tasks/
+│   └── main.yml
+├── handlers/
+│   └── main.yml (if needed)
+└── meta/
+    └── main.yml (if needed)
+```
+
+### Integration Points
+- **DNS Management**: Uses the existing `dns-manager` role for consistent DNS record creation
+- **Kubeconfig Management**: Uses the existing `kubeconfig-manager` role for local kubeconfig setup
+- **Firewall Configuration**: Reuses firewall service definitions from the first control plane role
+- **Cluster Integration**: Coordinates with the first control plane node to obtain join credentials
+
+### Dependencies
+- The first control plane node must be fully initialized and running
+- The `dns-manager` role must be available for DNS record creation
+- The `kubeconfig-manager` role must be available for kubeconfig setup
+- Required Kubernetes prerequisites must be installed on target nodes
+
+## Components and Interfaces
+
+### Main Task Flow
+1. **Pre-flight Checks**: Verify cluster readiness and node prerequisites
+2. **DNS Configuration**: Set up DNS records for the new control plane node
+3. **Firewall Configuration**: Open required ports for control plane services
+4. **Kubelet Configuration**: Create initial kubelet configuration
+5. **Join Token Retrieval**: Get join token and certificate key from first control plane
+6. **Cluster Join**: Execute kubeadm join with control plane flags
+7. **Service Management**: Ensure kubelet is enabled and running
+8. **Kubeconfig Setup**: Configure local kubeconfig access
+9. **Verification**: Validate successful cluster join
+
+### Key Variables
+- `cluster_name`: Name of the Kubernetes cluster
+- `ip_address`: IP address of the current control plane node
+- `first_control_plane_host`: Hostname/IP of the first control plane node
+- `kubernetes_services_control_plane`: List of firewall services to open
+- `join_token_ttl`: TTL for join tokens (default: 24h)
+- `certificate_key_ttl`: TTL for certificate keys (default: 2h)
+
+### External Role Interfaces
+- **dns-manager**: Provides DNS record creation with `host_name` variable
+- **kubeconfig-manager**: Handles kubeconfig merging with `cluster_name` variable
+- **First Control Plane**: Source for join tokens and certificate keys
+
+## Data Models
+
+### Join Credentials Structure
+```yaml
+join_credentials:
+  token: "abcdef.1234567890abcdef"
+  discovery_token_ca_cert_hash: "sha256:..."
+  certificate_key: "..."
+  api_server_endpoint: "cluster-name:6443"
+```
+
+### Firewall Services
+```yaml
+kubernetes_services_control_plane:
+  - kubernetes_API      # Port 6443
+  - etcd               # Ports 2379-2380
+  - kubelet            # Port 10250
+  - kube-scheduler     # Port 10259
+  - kube-controller-manager  # Port 10257
+```
+
+### Node Status Tracking
+```yaml
+node_status:
+  joined: false
+  kubelet_running: false
+  dns_configured: false
+  kubeconfig_ready: false
+```
+
+## Error Handling
+
+### Join Token Management
+- **Token Expiration**: Automatically generate new tokens if existing ones are expired
+- **Certificate Key Rotation**: Handle certificate key expiration gracefully
+- **Network Connectivity**: Retry join operations with exponential backoff
+- **API Server Availability**: Wait for API server readiness before attempting join
+
+### Idempotency Checks
+- **Already Joined Nodes**: Skip join process if node is already part of the cluster
+- **Existing Configuration**: Preserve existing kubelet configuration if valid
+- **DNS Records**: Update existing DNS records instead of creating duplicates
+- **Service Status**: Only restart services if configuration changes
+
+### Failure Recovery
+- **Partial Join Failures**: Clean up partial configurations and retry
+- **Network Issues**: Provide clear error messages for connectivity problems
+- **Permission Errors**: Validate sudo/root access before attempting operations
+- **Resource Constraints**: Check system resources before proceeding
+
+## Testing Strategy
+
+### Unit Testing Approach
+- **Task Validation**: Test individual tasks with mock data
+- **Variable Validation**: Ensure required variables are properly defined
+- **Conditional Logic**: Test all conditional branches in tasks
+- **Error Scenarios**: Validate error handling for common failure cases
+
+### Integration Testing
+- **Multi-Node Clusters**: Test with 3 and 5 control plane node configurations
+- **Network Scenarios**: Test across different network topologies
+- **OS Compatibility**: Validate on supported operating systems (Ubuntu/Debian)
+- **Version Compatibility**: Test with different Kubernetes versions
+
+### Validation Checks
+- **Cluster Health**: Verify all control plane nodes are healthy after join
+- **API Availability**: Confirm API server is accessible from all nodes
+- **Etcd Cluster**: Validate etcd cluster membership and health
+- **Scheduling**: Test pod scheduling across all control plane nodes
+- **Failover**: Verify cluster continues operating if one control plane fails
+
+### Test Scenarios
+1. **Fresh Join**: Join additional control plane to newly created cluster
+2. **Existing Cluster**: Add control plane to cluster with existing workloads
+3. **Network Partitions**: Test behavior during temporary network issues
+4. **Token Expiration**: Handle expired join tokens gracefully
+5. **Retry Operations**: Validate retry logic for transient failures
+
+## Implementation Considerations
+
+### Security
+- **Token Security**: Ensure join tokens are handled securely and not logged
+- **Certificate Management**: Properly manage and rotate certificate keys
+- **Network Security**: Validate firewall rules don't expose unnecessary ports
+- **Access Control**: Ensure proper RBAC is maintained after node joins
+
+### Performance
+- **Parallel Execution**: Support joining multiple control plane nodes simultaneously
+- **Resource Usage**: Monitor CPU and memory usage during join process
+- **Network Bandwidth**: Optimize data transfer during cluster join
+- **Startup Time**: Minimize time to achieve cluster readiness
+
+### Monitoring and Observability
+- **Join Progress**: Provide clear progress indicators during join process
+- **Health Checks**: Implement comprehensive health validation
+- **Logging**: Ensure adequate logging for troubleshooting
+- **Metrics**: Expose relevant metrics for monitoring cluster growth
+
+### Compatibility
+- **Kubernetes Versions**: Support current and previous Kubernetes versions
+- **Operating Systems**: Maintain compatibility with Ubuntu and Debian
+- **Container Runtimes**: Work with containerd runtime configuration
+- **Network Plugins**: Compatible with Flannel CNI configuration

.kiro/specs/fastpass-additional-control-plane/requirements.md

@@ -0,0 +1,77 @@
+# Requirements Document
+
+## Introduction
+
+This feature involves creating an Ansible role called `fastpass-additional-control-plane` that will deploy additional control plane nodes to an existing FastPass Kubernetes cluster. The role will follow the same pattern as the existing `fastpass-first-control-plane` role but will focus on joining nodes to an already initialized cluster rather than initializing a new cluster. This ensures high availability for the Kubernetes control plane by adding redundant master nodes.
+
+## Requirements
+
+### Requirement 1
+
+**User Story:** As a DevOps engineer, I want to deploy additional control plane nodes to my FastPass Kubernetes cluster, so that I can achieve high availability and fault tolerance for the cluster control plane.
+
+#### Acceptance Criteria
+
+1. WHEN the role is executed on a node THEN the system SHALL join the node to the existing Kubernetes cluster as a control plane node
+2. WHEN the role runs THEN the system SHALL configure the necessary firewall rules for control plane services
+3. WHEN the role executes THEN the system SHALL ensure the kubelet service is properly configured and running
+4. WHEN joining the cluster THEN the system SHALL use the correct join token and certificate key from the first control plane node
+5. WHEN the role completes THEN the system SHALL verify the node has successfully joined as a control plane node
+
+### Requirement 2
+
+**User Story:** As a system administrator, I want the additional control plane role to follow the same patterns as the first control plane role, so that the codebase remains consistent and maintainable.
+
+#### Acceptance Criteria
+
+1. WHEN the role is created THEN the system SHALL follow the same directory structure as fastpass-first-control-plane
+2. WHEN the role is implemented THEN the system SHALL use similar variable naming conventions and task organization
+3. WHEN the role runs THEN the system SHALL include proper error handling and idempotency checks
+4. WHEN the role executes THEN the system SHALL use the same firewall service definitions as the first control plane role
+5. WHEN the role is documented THEN the system SHALL include proper metadata headers with author, version, and description
+
+### Requirement 3
+
+**User Story:** As a cluster operator, I want the additional control plane nodes to have proper DNS configuration, so that they can be reached by their cluster names and participate in load balancing.
+
+#### Acceptance Criteria
+
+1. WHEN the role runs THEN the system SHALL configure DNS records for the additional control plane nodes
+2. WHEN DNS is configured THEN the system SHALL use the dns-manager role for consistency
+3. WHEN the role executes THEN the system SHALL ensure the node can resolve the cluster endpoint
+4. WHEN DNS setup completes THEN the system SHALL verify connectivity to the cluster API endpoint
+
+### Requirement 4
+
+**User Story:** As a DevOps engineer, I want the role to handle kubeconfig management for additional control plane nodes, so that I can manage the cluster from any control plane node.
+
+#### Acceptance Criteria
+
+1. WHEN the role completes THEN the system SHALL configure kubeconfig for the new control plane node
+2. WHEN kubeconfig is set up THEN the system SHALL use the kubeconfig-manager role for consistency
+3. WHEN the role runs THEN the system SHALL ensure proper permissions are set on kubeconfig files
+4. WHEN kubeconfig is configured THEN the system SHALL verify kubectl access works from the new node
+
+### Requirement 5
+
+**User Story:** As a system administrator, I want the role to be idempotent and handle edge cases, so that I can run it multiple times safely without causing issues.
+
+#### Acceptance Criteria
+
+1. WHEN the role is run multiple times THEN the system SHALL not attempt to rejoin an already joined node
+2. WHEN a node is already part of the cluster THEN the system SHALL skip the join process gracefully
+3. WHEN the role encounters errors THEN the system SHALL provide clear error messages and fail gracefully
+4. WHEN prerequisites are missing THEN the system SHALL report what needs to be configured first
+5. WHEN the role runs THEN the system SHALL validate that required variables are defined
+
+### Requirement 6
+
+**User Story:** As a cluster administrator, I want the role to integrate seamlessly with the existing FastPass deployment workflow, so that it can be used in the 4-step deployment process.
+
+#### Acceptance Criteria
+
+1. WHEN the role is created THEN the system SHALL be compatible with the deploy-fastpass-4step.yml playbook
+2. WHEN the role runs THEN the system SHALL work with the fastpass_control_plane[1:] host group
+3. WHEN integrated THEN the system SHALL not interfere with the first control plane initialization
+4. WHEN the role executes THEN the system SHALL depend on the first control plane node being ready
+5. WHEN deployment completes THEN the system SHALL allow worker nodes to join the cluster successfully

.kiro/specs/fastpass-additional-control-plane/tasks.md

@@ -0,0 +1,118 @@
+# Implementation Plan
+
+- [ ] 1. Create role directory structure and basic configuration
+  - Create the fastpass-additional-control-plane role directory structure
+  - Set up defaults/main.yml with required variables and firewall services
+  - Create meta/main.yml with role metadata and dependencies
+  - _Requirements: 2.1, 2.2, 2.4_
+
+- [ ] 2. Implement join token and certificate key retrieval
+  - [ ] 2.1 Create tasks to generate new join tokens from first control plane
+    - Write Ansible tasks to execute kubeadm token create on first control plane node
+    - Implement token validation and expiration checking
+    - Add error handling for token generation failures
+    - _Requirements: 1.4, 5.4_
+
+  - [ ] 2.2 Implement certificate key retrieval and management
+    - Create tasks to upload and retrieve certificate keys from first control plane
+    - Add certificate key expiration handling and rotation
+    - Implement secure handling of certificate keys in variables
+    - _Requirements: 1.4, 5.1_
+
+  - [ ] 2.3 Create discovery token CA certificate hash retrieval
+    - Write tasks to extract CA certificate hash from first control plane
+    - Implement validation of certificate hash format
+    - Add error handling for certificate retrieval failures
+    - _Requirements: 1.4, 5.4_
+
+- [ ] 3. Implement DNS configuration and firewall setup
+  - [ ] 3.1 Configure DNS records for additional control plane nodes
+    - Integrate dns-manager role for consistent DNS record creation
+    - Pass appropriate host_name variable to dns-manager
+    - Add DNS propagation wait and validation
+    - _Requirements: 3.1, 3.2, 3.4_
+
+  - [ ] 3.2 Set up firewall rules for control plane services
+    - Reuse kubernetes_services_control_plane from defaults
+    - Implement UFW firewall rule creation for Debian/Ubuntu systems
+    - Add conditional logic for different operating systems
+    - _Requirements: 1.2, 2.4_
+
+- [ ] 4. Implement kubelet configuration and cluster join
+  - [ ] 4.1 Create initial kubelet configuration
+    - Write kubelet config.yaml with systemd cgroup driver
+    - Set containerd socket endpoint configuration
+    - Ensure proper file permissions and ownership
+    - _Requirements: 1.3, 2.3_
+
+  - [ ] 4.2 Execute kubeadm join for control plane
+    - Implement kubeadm join command with control-plane flag
+    - Use retrieved join token, certificate key, and CA cert hash
+    - Add proper command argument construction and validation
+    - Include idempotency checks to prevent duplicate joins
+    - _Requirements: 1.1, 1.4, 5.1, 5.2_
+
+  - [ ] 4.3 Ensure kubelet service management
+    - Enable and start kubelet systemd service
+    - Add service status validation and error handling
+    - Implement service restart logic if needed
+    - _Requirements: 1.3, 1.5_
+
+- [ ] 5. Implement kubeconfig management and validation
+  - [ ] 5.1 Configure kubeconfig for additional control plane nodes
+    - Integrate kubeconfig-manager role for consistent configuration
+    - Pass cluster_name variable to kubeconfig-manager
+    - Ensure proper kubeconfig merging with existing configurations
+    - _Requirements: 4.1, 4.2, 4.3_
+
+  - [ ] 5.2 Implement cluster join validation
+    - Create tasks to verify node successfully joined as control plane
+    - Add kubectl commands to check node status and roles
+    - Implement cluster health validation checks
+    - _Requirements: 1.5, 4.4_
+
+- [ ] 6. Add comprehensive error handling and idempotency
+  - [ ] 6.1 Implement pre-flight validation checks
+    - Check if node is already joined to cluster
+    - Validate required variables are defined
+    - Verify first control plane node accessibility
+    - Add system resource and prerequisite checks
+    - _Requirements: 5.1, 5.2, 5.4, 5.5_
+
+  - [ ] 6.2 Add retry logic and failure recovery
+    - Implement retry mechanisms for transient failures
+    - Add exponential backoff for network-related operations
+    - Create cleanup tasks for partial join failures
+    - _Requirements: 5.3, 5.4_
+
+- [ ] 7. Integration with FastPass deployment workflow
+  - [ ] 7.1 Ensure compatibility with deploy-fastpass-4step.yml
+    - Verify role works with fastpass_control_plane[1:] host group
+    - Test integration with existing playbook structure
+    - Validate dependency on first control plane completion
+    - _Requirements: 6.1, 6.2, 6.3, 6.4_
+
+  - [ ] 7.2 Add proper task documentation and metadata
+    - Include role header with author, version, and description
+    - Add inline comments for complex task logic
+    - Document required variables and their purposes
+    - _Requirements: 2.2, 2.5_
+
+- [ ]* 8. Create comprehensive testing and validation
+  - [ ]* 8.1 Write unit tests for individual tasks
+    - Create test cases for token retrieval logic
+    - Test kubeadm join command construction
+    - Validate error handling scenarios
+    - _Requirements: 1.1, 1.4, 5.1_
+
+  - [ ]* 8.2 Implement integration tests
+    - Test multi-node control plane deployment
+    - Validate cluster health after additional nodes join
+    - Test failover scenarios and cluster resilience
+    - _Requirements: 1.5, 6.5_
+
+  - [ ]* 8.3 Add validation scripts and health checks
+    - Create scripts to verify cluster state after deployment
+    - Implement automated health validation
+    - Add performance and resource usage monitoring
+    - _Requirements: 1.5, 4.4_

.kiro/specs/fastpass-dns-loadbalancer-fix/requirements.md

@@ -0,0 +1,51 @@
+# Requirements Document
+
+## Introduction
+
+The FastPass Kubernetes cluster deployment currently has critical DNS and load balancing configuration issues that prevent proper high availability setup. While the cluster endpoint `fastpass.local.mk-labs.cloud` is defined in the group variables, the `cluster_vip` variable required by the DNS manager role is missing, and the Traefik load balancer configuration is commented out. This means the cluster endpoint cannot resolve properly and there's no load balancing for the control plane API. This feature will fix these configuration gaps to enable true HA functionality.
+
+## Requirements
+
+### Requirement 1: DNS CNAME Record for Load Balancer
+
+**User Story:** As a DevOps engineer, I want the DNS manager to create a CNAME record for the cluster endpoint pointing to the load balancer, so that the cluster endpoint resolves through the load balancer rather than directly to node IPs.
+
+#### Acceptance Criteria
+
+1. WHEN the dns-manager role is called for a load-balanced cluster THEN the system SHALL create a CNAME record instead of an A record
+2. WHEN the CNAME record is created THEN the system SHALL point fastpass.local.mk-labs.cloud to the traefik_server (lightning_lane.local.mk-labs.cloud)
+3. WHEN the DNS record type is determined THEN the system SHALL use CNAME for load-balanced endpoints and A records for direct node access
+4. WHEN DNS propagation occurs THEN the system SHALL verify that the CNAME resolution works correctly
+
+### Requirement 2: Complete Traefik Integration
+
+**User Story:** As a DevOps engineer, I want the Traefik load balancer to be fully integrated with the FastPass deployment, so that the cluster VIP is properly load balanced across all control plane nodes.
+
+#### Acceptance Criteria
+
+1. WHEN the traefik-manager role is called THEN the system SHALL use the traefik_server variable (lightning_lane) as the target host
+2. WHEN Traefik configuration is generated THEN the system SHALL create proper TCP routing for the cluster endpoint to all control plane nodes
+3. WHEN the cluster VIP is accessed THEN the system SHALL distribute requests across space-mountain, big-thunder-mountain, and splash-mountain
+4. WHEN Traefik configuration is applied THEN the system SHALL reload the Traefik service to activate the new configuration
+
+### Requirement 3: High Availability Validation
+
+**User Story:** As a DevOps engineer, I want to validate that the HA setup is working correctly, so that I can be confident the cluster will survive node failures.
+
+#### Acceptance Criteria
+
+1. WHEN the deployment completes THEN the system SHALL test connectivity to the cluster endpoint
+2. WHEN connectivity tests run THEN the system SHALL verify that the endpoint resolves through the CNAME to the load balancer
+3. WHEN load balancer tests run THEN the system SHALL verify that requests are being distributed across control plane nodes
+4. WHEN a control plane node is stopped THEN the system SHALL continue to serve API requests through the remaining nodes
+
+### Requirement 4: Backward Compatibility
+
+**User Story:** As a DevOps engineer, I want the DNS fixes to be backward compatible with existing deployments, so that current clusters continue to function during the transition.
+
+#### Acceptance Criteria
+
+1. WHEN existing clusters are updated THEN the system SHALL not break existing DNS configurations
+2. WHEN new variables are introduced THEN the system SHALL provide sensible defaults for existing deployments
+3. WHEN the update is applied THEN the system SHALL preserve existing kubeconfig files and cluster access
+4. IF migration issues occur THEN the system SHALL provide rollback procedures and documentation

00-core-infra/ansible/group_vars/unbound_servers/main.yml

@@ -1,5 +0,0 @@
----
-unbound_do_ip6: "no"
-#unbound_forward_zones:
-unbound_chroot: "/etc/unbound"
-#unbound_pidfile: "/etc/unbound/unbound.pid"

00-core-infra/ansible/host_vars/unbound/vars/main.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound.int.mk-labs.cloud

00-core-infra/ansible/host_vars/unbound01.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound01.int.mk-labs.cloud

00-core-infra/ansible/host_vars/unbound02.yml

@@ -1,2 +0,0 @@
----
-hostname: unbound02.int.mk-labs.cloud

00-core-infra/ansible/inventory

@@ -1,32 +0,0 @@
----
-proxmox:
-  hosts:
-    pve01:
-      ansible_host: 10.10.21.51
-    pve02:
-      ansible_host: 10.10.21.52
-    pve03:
-      ansible_host: 10.10.21.53
-
-unbound_servers:
-  hosts:
-    unbound:
-      ansible_host: 10.1.71.254
-    unbound01:
-      ansible_host: 10.1.71.254
-    unbound02:
-      ansible_host: 10.1.71.253
-
-ipaserver:
-  hosts:
-    infra01:
-      ansible_host: 10.1.71.5
-
-ipareplicas:
-  hosts:
-#    infra02.int.mk-labs.cloud:
-#      ansible_host: 10.1.71.6
-      
-#infra:
-#  hosts:
-#    awx.int.mk-labs.cloud:

00-core-infra/ansible/roles/unbound/files/unbound.conf

@@ -1,236 +0,0 @@
-## Authoritative, validating, recursive caching DNS
-## unbound.conf -- https://calomel.org
-#
-server:
-  # log verbosity
-    verbosity: 1
-    chroot: ""
-
-  # specify the interfaces to answer queries from by ip-address.  The default
-  # is to listen to localhost (127.0.0.1 and ::1).  specify 0.0.0.0 and ::0 to
-  # bind to all available interfaces.  specify every interface[@port] on a new
-  # 'interface:' labeled line.  The listen interfaces are not changed on
-  # reload, only on restart.
-    interface: 0.0.0.0
-
-  # port to answer queries from
-    port: 53
-
-  # Enable IPv4, "yes" or "no".
-    do-ip4: yes
-
-  # Enable IPv6, "yes" or "no".
-    do-ip6: no
-
-  # Enable UDP, "yes" or "no".
-    do-udp: yes
-
-  # Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually
-  # quicker to resolve as the functions related to TCP checks are not done.i
-  # NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains
-  # due to their size.
-    do-tcp: yes
-
-  # control which client ips are allowed to make (recursive) queries to this
-  # server. Specify classless netblocks with /size and action.  By default
-  # everything is refused, except for localhost.  Choose deny (drop message),
-  # refuse (polite error reply), allow (recursive ok), allow_snoop (recursive
-  # and nonrecursive ok)
-    access-control: 192.168.1.0/24 allow
-    access-control: 192.168.3.0/24 allow
-    access-control: 192.168.10.0/24 allow
-    access-control: 10.1.71.0/24 allow
-
-  # Read  the  root  hints from this file. Default is nothing, using built in
-  # hints for the IN class. The file has the format of  zone files,  with  root
-  # nameserver  names  and  addresses  only. The default may become outdated,
-  # when servers change,  therefore  it is good practice to use a root-hints
-  # file.  get one from https://www.internic.net/domain/named.root 
-    root-hints: "/etc/unbound/root.hints"
-
-  # enable to not answer id.server and hostname.bind queries.
-    hide-identity: yes
-
-  # enable to not answer version.server and version.bind queries.
-    hide-version: yes
-
-  # Will trust glue only if it is within the servers authority.
-  # Harden against out of zone rrsets, to avoid spoofing attempts. 
-  # Hardening queries multiple name servers for the same data to make
-  # spoofing significantly harder and does not mandate dnssec.
-    harden-glue: yes
-
-  # Require DNSSEC data for trust-anchored zones, if such data is absent, the
-  # zone becomes  bogus.  Harden against receiving dnssec-stripped data. If you
-  # turn it off, failing to validate dnskey data for a trustanchor will trigger
-  # insecure mode for that zone (like without a trustanchor).  Default on,
-  # which insists on dnssec data for trust-anchored zones.
-    harden-dnssec-stripped: yes
-
-  # Use 0x20-encoded random bits in the query to foil spoof attempts.
-  # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
-  # While upper and lower case letters are allowed in domain names, no significance
-  # is attached to the case. That is, two names with the same spelling but
-  # different case are to be treated as if identical. This means calomel.org is the
-  # same as CaLoMeL.Org which is the same as CALOMEL.ORG.
-    use-caps-for-id: yes
-
-  # the time to live (TTL) value lower bound, in seconds. Default 0.
-  # If more than an hour could easily give trouble due to stale data.
-    cache-min-ttl: 3600
-
-  # the time to live (TTL) value cap for RRsets and messages in the
-  # cache. Items are not cached for longer. In seconds.
-    cache-max-ttl: 86400
-
-  # perform prefetching of close to expired message cache entries.  If a client
-  # requests the dns lookup and the TTL of the cached hostname is going to
-  # expire in less than 10% of its TTL, unbound will (1st) return the ip of the
-  # host to the client and (2nd) pre-fetch the dns request from the remote dns
-  # server. This method has been shown to increase the amount of cached hits by
-  # local clients by 10% on average.
-    prefetch: yes
-
-  # number of threads to create. 1 disables threading. This should equal the number
-  # of CPU cores in the machine. Our example machine has 4 CPU cores.
-    num-threads: 2
-
-
-  ## Unbound Optimization and Speed Tweaks ###
-
-  # the number of slabs to use for cache and must be a power of 2 times the
-  # number of num-threads set above. more slabs reduce lock contention, but
-  # fragment memory usage.
-    msg-cache-slabs: 8
-    rrset-cache-slabs: 8
-    infra-cache-slabs: 8
-    key-cache-slabs: 8
-
-  # Increase the memory size of the cache. Use roughly twice as much rrset cache
-  # memory as you use msg cache memory. Due to malloc overhead, the total memory
-  # usage is likely to rise to double (or 2.5x) the total cache memory. The test
-  # box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
-    rrset-cache-size: 256m
-    msg-cache-size: 128m
-
-  # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
-  # the kernel buffer larger so that no messages are lost in spikes in the traffic.
-    so-rcvbuf: 1m
-
-  ## Unbound Optimization and Speed Tweaks ###
-
-
-  # Enforce privacy of these addresses. Strips them away from answers.  It may
-  # cause DNSSEC validation to additionally mark it as bogus.  Protects against
-  # 'DNS Rebinding' (uses browser as network proxy).  Only 'private-domain' and
-  # 'local-data' names are allowed to have these private addresses. No default.
-    private-address: 192.168.1.0/24
-    private-address: 192.168.3.0/24
-    private-address: 192.168.10.0/24
-    private-address: 10.1.71.0/24
-
-  # Allow the domain (and its subdomains) to contain private addresses.
-  # local-data statements are allowed to contain private addresses too.
-    private-domain: "mk-labs.cloud"
-
-  # If nonzero, unwanted replies are not only reported in statistics, but also
-  # a running total is kept per thread. If it reaches the threshold, a warning
-  # is printed and a defensive action is taken, the cache is cleared to flush
-  # potential poison out of it.  A suggested value is 10000000, the default is
-  # 0 (turned off). We think 10K is a good value.
-    unwanted-reply-threshold: 10000
-
-  # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND  on
-  # localhost you will want to allow the resolver to send queries to localhost.
-  # Make sure to set do-not-query-localhost: yes . If yes, the above default
-  # do-not-query-address entries are present.  if no, localhost can be queried
-  # (for testing and debugging). 
-    do-not-query-localhost: no
-
-  # File with trusted keys, kept up to date using RFC5011 probes, initial file
-  # like trust-anchor-file, then it stores metadata.  Use several entries, one
-  # per domain name, to track multiple zones. If you use forward-zone below to
-  # query the Google DNS servers you MUST comment out this option or all DNS
-  # queries will fail.
-   #auto-trust-anchor-file: "/etc/unbound/root.key"
-
-  # Should additional section of secure message also be kept clean of unsecure
-  # data. Useful to shield the users of this validator from potential bogus
-  # data in the additional section. All unsigned data in the additional section
-  # is removed from secure messages.
-    val-clean-additional: yes
-
-  # Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo
-  # account for a 70 percent share of all advertising traffic. Block them.
-  # local-zone: "doubleclick.net" redirect
-  # local-data: "doubleclick.net A 127.0.0.1"
-  # local-zone: "googlesyndication.com" redirect
-  # local-data: "googlesyndication.com A 127.0.0.1"
-  # local-zone: "googleadservices.com" redirect
-  # local-data: "googleadservices.com A 127.0.0.1"
-  # local-zone: "google-analytics.com" redirect
-  # local-data: "google-analytics.com A 127.0.0.1"
-  # local-zone: "ads.youtube.com" redirect
-  # local-data: "ads.youtube.com A 127.0.0.1"
-  # local-zone: "adserver.yahoo.com" redirect
-  # local-data: "adserver.yahoo.com A 127.0.0.1"
-  # local-zone: "ask.com" redirect
-  # local-data: "ask.com A 127.0.0.1"
-
-  # Unbound will not load if you specify the same local-zone and local-data
-  # servers in the main configuration as well as in this "include:" file. We
-  # suggest commenting out any of the local-zone and local-data lines above if
-  # you suspect they could be included in the unbound_ad_servers servers file.
-  #include: "/etc/unbound/unbound_ad_servers"
-
-  # locally served zones can be configured for the machines on the LAN.
-
-#    local-zone: "home.lan." static
-
-#    local-data: "firewall.home.lan.  IN A 10.0.0.1"
-
-#    local-data-ptr: "10.0.0.1  firewall.home.lan"
-
-  # Unbound can query your NSD or BIND server for private domain queries too.
-  # On our NSD page we have NSD configured to serve the private domain,
-  # "home.lan". Here we can tell Unbound to connect to the NSD server when it
-  # needs to resolve a *.home.lan hostname or IP.
-  #
-  # private-domain: "home.lan"
-  # local-zone: "0.0.10.in-addr.arpa." nodefault
-  # stub-zone:
-  #      name: "home.lan"
-  #      stub-addr: 10.0.0.111@53
-
-  # If you have an internal or private DNS names the external DNS servers can
-  # not resolve, then you can assign domain name strings to be redirected to a
-  # seperate dns server. For example, our comapny has the domain
-  # organization.com and the domain name internal.organization.com can not be
-  # resolved by Google's public DNS, but can be resolved by our private DNS
-  # server located at 1.1.1.1. The following tells Unbound that any
-  # organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
-  # instead of the public dns servers.
-  #
-  forward-zone:
-      name: "int.mk-labs.cloud"
-      forward-addr: 10.1.71.5        # Internal or private DNS
-
-  # Use the following forward-zone to forward all queries to Google DNS,
-  # OpenDNS.com or your local ISP's dns servers for example. To test resolution
-  # speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
-  # milliseconds.
-  #
-  forward-zone:
-    name: "."
-    forward-addr: 1.0.0.1@53#one.one.one.one
-    forward-addr: 1.1.1.1@53#one.one.one.one
-#   forward-addr: 8.8.8.8@53#dns.google
-#   forward-addr: 9.9.9.9@53#dns.quad9.net
-#   forward-addr: 1.0.0.1@53#one.one.one.one
-#   forward-addr: 8.8.4.4@53#dns.google
-#   forward-addr: 149.112.112.112@53#dns.quad9.net
-
-#
-#
-## Authoritative, validating, recursive caching DNS
-## unbound.conf -- https://calomel.org

10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2

@@ -1,25 +0,0 @@
-apiVersion: v1
-baseDomain: {{ hostvars[groups['hub-cluster'][0]].base_domain }}
-compute:
-- name: worker
-  replicas: {{ hostvars[groups['hub-cluster'][0]].worker_node_count }}
-controlPlane:
-  hyperthreading: Enabled
-  name: master
-  replicas: {{ hostvars[groups['hub-cluster'][0]].master_node_count }}
-metadata:
-  name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
-networking:
-  clusterNetwork:
-  - cidr: {{ hostvars[groups['hub-cluster'][0]].cluster_network }}
-    hostPrefix: {{ hostvars[groups['hub-cluster'][0]].cluster_network_host_prefix }}
-  machineNetwork:
-  - cidr: {{ hostvars[groups['hub-cluster'][0]].machine_network }}
-  networkType: OVNKubernetes
-  serviceNetwork:
-  - {{ hostvars[groups['hub-cluster'][0]].service_network }}
-platform:
-  {{ hostvars[groups['hub-cluster'][0]].platform_type }}: {}
-fips: false
-pullSecret: '{{ vault_pull_secret }}'
-sshKey: '{{ vault_ssh_key }}'

10-sno-hub-cluster/README.md

@@ -1 +0,0 @@
-# Moved to other documentation

README.md

@@ -1,9 +1,152 @@
 # A Homelab based on Red Hat Technologies
 
-This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift.
+A comprehensive homelab for learning advanced concepts primarily based on Red Hat OpenShift.  In addition to providing services, it is an area to incorporate container technologies, and enterprise integration scenarios.
 
 This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
 
+## 🎯 Project Goals
+
+- **Kubernetes cluster for applications**
+- **IAM integration testing**
+- **GitOps and automation workflows**
+
+## 📋 Documentation (Priority Order)
+
+### Phase 1: Foundation
+1. **[Overview & Hardware Allocation](./docs/01-overview.md)** - Complete architecture overview
+2. **[Networking Plan](./docs/02-networking.md)** - VLAN strategy and network design
+3. **[Core Services Setup](./docs/03-core-services.md)** *(TBD)* - Ansible, DNS, monitoring
+4. **[Storage Configuration](./docs/04-storage.md)** *(TBD)* - Synology, democratic-csi
+
+### Phase 2: Proxmox Platform
+5. **[Proxmox Installation](./docs/11-vsphere-setup.md)** *(TBD)* - Dell 7050 virtualization
+6. **[VM Templates & Automation](./docs/13-vm-automation.md)** *(TBD)* - Template creation
+
+### Phase 3: Infrastructure Services
+7. **[Recursive DNS]
+8. **[Authoritative DNS]
+9. **[Identity Management](./docs/10-acm-setup.md)** *(TBD)*
+10. **[Matchbox] (Depreciated?)
+
+### Phase 4: OpenShift Clusters (Depreciated)
+8. **[OpenShift SNO + Worker](./docs/09-openshift-sno.md)** *(TBD)* - ACM Hub Cluster
+9. **[OpenShift Cluster](./docs/08-openshift-compact.md)** *(TBD)* - 3 Master/3 Worker node (production-like)
+10. **[ACM Configuration](./docs/10-acm-setup.md)** *(TBD)* - Multi-cluster management
+11. **[HCP Cluster](./docs/10-acm-setup.md)** *(TBD)* - External app cluster
+
+### Phase 5: Kubernetes Container Platform
+5. **[Container Registry Setup](./docs/05-container-registry.md)** *(TBD)* - Harbor deployment
+6. **[Git Repository Setup](./docs/06-git-repository.md)** *(TBD)* - Gitea/GitLab on Synology
+7. **[Artifact Repository](./docs/07-artifact-repository.md)** *(TBD)* - Nexus/Artifactory
+
+### Phase 6: Advanced Services
+14. **[Monitoring & Observability](./docs/14-monitoring.md)** *(TBD)* - Prometheus, Grafana, Splunk
+15. **[Security & Compliance](./docs/15-security.md)** *(TBD)* - ACS, certificates, auditing
+16. **[Backup & DR](./docs/16-backup-dr.md)** *(TBD)* - Backup strategies
+
+## 🚀 Quick Start Deployment
+
+### Prerequisites
+- Ubiquiti UDM Pro configured
+- Hardware powered and networked
+- Initial VLAN setup (see [networking plan](./docs/02-networking.md))
+
+### Ansible Collections
+- ansible-galaxy collection install freeipa.ansible_freeipa
+
+### Deployment Scripts
+
+```bash
+source ~/venv-ansible/bin/activate
+# Phase 1: Foundation
+./scripts/01-network-setup.sh
+./scripts/02-core-services-deploy.sh
+
+# Phase 2: Container Platform  
+./deployment/synology/docker-compose.yml  # Git repo, Harbor, Nexus
+./scripts/03-storage-setup.sh
+
+# Phase 3: OpenShift
+./deployment/openshift/compact-cluster/
+./deployment/openshift/sno-cluster/
+
+# Phase 4: Proxmox
+./deployment/proxmox/
+```
+
+## 📁 Repository Structure
+
+```
+homelab/
+├── README.md                    # This file
+├── docs/                        # Documentation (numbered by priority)
+│   ├── 01-overview.md
+│   ├── 02-networking.md
+│   └── ...
+├── ansible/                     # Directory structure for Ansible 
+├── deployment/                  # Deployment 
+configurations
+│   ├── synology/                # Docker Compose files for Synology
+│   ├── k0s/                     # k0s cluster manifests
+│   ├── openshift/               # OpenShift installation configs
+│   └── proxmox/                 # Proxmox automation
+├── scripts/                     # Automation scripts
+└── .gitignore                   # Excludes sensitive data
+```
+
+## 🔧 Technology Stack
+
+### Infrastructure
+- **Networking**: Ubiquiti UDM Pro
+- **Storage**: Synology DS1621+, Ubiquiti UNAS Pro
+- **Compute**: 3x Minisforum TH60, 2x Minisforum MS01, 7x Dell 7050 SFF
+
+### Container Platforms
+- **k8s**: Core services cluster
+- **Proxmox**: VM workloads
+
+### Core Services
+- **Container Registry**: Harbor
+- **Git Repository**: Gitea/GitLab CE
+- **Artifact Repository**: Nexus/Artifactory
+- **Monitoring**: Prometheus + Grafana
+- **Logging**: Splunk Enterprise
+- **DNS**: CoreDNS
+- **Load Balancing**: MetalLB + HAProxy
+
+## 🔐 Security Notes
+
+- **No sensitive data** is stored in this repository
+- **Secrets management** via external-secrets-operator
+- **Certificate management** via cert-manager
+- **Network segmentation** via VLANs and firewall rules
+
+## 🤝 Contributing
+
+This is a personal homelab project, but feel free to:
+- Submit issues for questions or suggestions
+- Fork for your own homelab adaptations
+- Share improvements via pull requests
+
+## 📞 Next Steps
+
+1. **Create GitHub repository** for version control
+2. **Start with Phase 1** foundation setup
+3. **Build deployment automation** as we go
+4. **Document lessons learned** for future reference
+
+---
+
+**Status**: 🚧 Planning & Initial Development
+
+**Last Updated**: June 2025
+
+This repo is a mono-repo that is broken up into three sections:
+
+- infra-config
+- apps
+- cluster
+
 ## Hardware
 
 - Dell 7050 SFF (7)
@@ -52,7 +195,7 @@ A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a H
 - Advanced Cluster Management
 - Ansible Automation Platform
 - Vault
-- OpenShift GitOps
+- ~~OpenShift GitOps~~
 
 #### Network Prerequisites
 
@@ -88,6 +231,7 @@ This makes it to where you just need 3 bare metal nodes. You could run one HCP B
 You'll also either need you just need at least 2 bare metal nodes.
 
 ---
+
 ## Credits
 
 - Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.

ansible/DNS_MANAGEMENT_REFACTOR.md

@@ -0,0 +1,193 @@
+# DNS Management Refactor - Modular & Repeatable
+
+This document explains the refactoring of DNS management from standalone playbooks to modular, reusable tasks.
+
+## 🎯 **What Changed**
+
+### **Before (Monolithic)**
+```yaml
+# Standalone playbook: add_technitium_dns_entry.yml
+- name: Add entry to Technitium DNS
+  hosts: all
+  tasks:
+    - name: Create DNS entry
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        # ... hardcoded parameters
+```
+
+### **After (Modular)**
+```yaml
+# Reusable task: tasks/add_technitium_dns_entry.yml
+- name: Create DNS entry for {{ dns_record_name }}
+  effectivelywild.technitium_dns.technitium_dns_add_record:
+    # ... parameterized with variables
+```
+
+## 📁 **New Structure**
+
+```
+ansible/
+├── playbooks/
+│   ├── tasks/
+│   │   └── add_technitium_dns_entry.yml    # ✅ Reusable task file
+│   ├── add_dns_entry.yml                   # ✅ New playbook using task
+│   ├── add_technitium_dns_entry.yml.backup # 📦 Backed up old version
+│   └── roles/
+│       └── dns-manager/                    # ✅ Enhanced role
+│           ├── tasks/main.yml              # Uses task file
+│           └── defaults/main.yml           # Technitium defaults
+└── scripts/
+    └── migrate-dns-references.sh           # ✅ Migration helper
+```
+
+## 🚀 **Usage Examples**
+
+### **1. In Playbooks (Direct Task Include)**
+```yaml
+- name: Add DNS entry for my server
+  hosts: my_servers
+  tasks:
+    - name: Create DNS entry
+      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+      vars:
+        dns_record_name: "{{ inventory_hostname }}"
+        dns_zone: "{{ base_domain }}"
+        dns_ip_address: "{{ ansible_default_ipv4.address }}"
+```
+
+### **2. Using the DNS Manager Role**
+```yaml
+- name: Setup cluster DNS
+  hosts: control_plane[0]
+  roles:
+    - role: dns-manager
+      vars:
+        cluster_endpoint: "my-cluster.local.mk-labs.cloud"
+        cluster_vip: "10.1.71.100"
+```
+
+### **3. Using the New Playbook**
+```yaml
+# Import the new modular playbook
+- import_playbook: add_dns_entry.yml
+```
+
+### **4. In Cluster Network Setup**
+```yaml
+- name: Setup complete cluster network
+  ansible.builtin.include_role:
+    name: cluster-network-setup
+  vars:
+    cluster_name: "fastpass"
+    cluster_endpoint: "fastpass.local.mk-labs.cloud"
+    cluster_vip: "10.1.71.53"
+```
+
+## 🔧 **Migration Guide**
+
+### **Automatic Migration**
+```bash
+# Run the migration script to find references
+./scripts/migrate-dns-references.sh
+```
+
+### **Manual Updates**
+
+1. **Replace playbook imports:**
+   ```yaml
+   # OLD
+   - import_playbook: add_technitium_dns_entry.yml
+   
+   # NEW
+   - import_playbook: add_dns_entry.yml
+   ```
+
+2. **Use task includes in roles:**
+   ```yaml
+   - ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+     vars:
+       dns_record_name: "my-server"
+       dns_ip_address: "10.1.71.100"
+   ```
+
+3. **Use the dns-manager role:**
+   ```yaml
+   - ansible.builtin.include_role:
+       name: dns-manager
+   ```
+
+## 📋 **Variable Reference**
+
+### **Task Variables (`tasks/add_technitium_dns_entry.yml`)**
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `dns_record_name` | `inventory_hostname` | DNS record name |
+| `dns_zone` | `base_domain` | DNS zone |
+| `dns_ip_address` | `ip_address` | IP address for A record |
+| `dns_record_type` | `A` | DNS record type |
+| `dns_ttl` | `360` | TTL in seconds |
+| `dns_create_ptr` | `true` | Create PTR record |
+| `dns_debug` | `true` | Show debug output |
+
+### **DNS Manager Role Variables**
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `cluster_endpoint` | - | Full cluster FQDN |
+| `cluster_vip` | - | Cluster VIP address |
+| `dns_management_enabled` | `true` | Enable DNS management |
+| `use_hosts_file_fallback` | `true` | Add to /etc/hosts |
+| `dns_ttl` | `360` | DNS TTL |
+| `create_ptr_record` | `true` | Create PTR record |
+
+## 🎯 **Benefits**
+
+### ✅ **Modularity**
+- Single task file used across multiple contexts
+- Consistent DNS management approach
+- Easy to maintain and update
+
+### ✅ **Flexibility**
+- Works in playbooks, roles, and standalone
+- Parameterized for different use cases
+- Supports multiple DNS providers (extensible)
+
+### ✅ **Maintainability**
+- One place to update DNS logic
+- Clear variable interface
+- Better error handling and debugging
+
+### ✅ **Integration**
+- Seamlessly integrates with cluster setup
+- Works with existing homelab infrastructure
+- Compatible with Traefik load balancer setup
+
+## 🔄 **Integration with Cluster Setup**
+
+The DNS management now integrates seamlessly with your cluster deployment:
+
+```yaml
+# In fastpass-first-control-plane role
+- name: Setup network infrastructure for FastPass cluster
+  ansible.builtin.include_role:
+    name: cluster-network-setup
+  vars:
+    cluster_name: "{{ cluster_name }}"
+    cluster_endpoint: "{{ control_plane_endpoint }}"
+    cluster_vip: "{{ ansible_default_ipv4.address }}"
+    control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
+```
+
+This automatically:
+1. ✅ Creates DNS entry for `fastpass.local.mk-labs.cloud`
+2. ✅ Configures Traefik load balancer
+3. ✅ Tests connectivity
+4. ✅ Provides fallback to /etc/hosts
+
+## 🚀 **Next Steps**
+
+1. **Test the refactored approach** with your FastPass cluster
+2. **Extend to other clusters** (Hub, Internal) using the same pattern
+3. **Add support for other DNS providers** if needed
+4. **Create monitoring** for DNS health checks
+
+This modular approach makes your homelab's DNS management much more maintainable and repeatable across all your Kubernetes clusters!

ansible/FASTPASS_DEPLOYMENT_GUIDE.md

@@ -0,0 +1,309 @@
+# FastPass Kubernetes Cluster - Complete Deployment Guide
+
+## Overview
+
+This guide provides step-by-step instructions for deploying a complete Kubernetes cluster on Fedora using Ansible automation. The FastPass cluster is designed for high availability with multiple control plane nodes and worker nodes.
+
+## Prerequisites
+
+### System Requirements
+- **OS**: Fedora 38+ (64-bit)
+- **Memory**: Minimum 2GB RAM per node
+- **CPU**: Minimum 2 cores per node
+- **Storage**: Minimum 10GB free space
+- **Network**: All nodes must be able to communicate
+
+### Software Requirements
+- Ansible 2.15+
+- Python 3.8+
+- SSH access to all nodes with sudo privileges
+
+## Quick Start
+
+### 1. Validate Your Setup
+
+Before deploying, run the validation script:
+
+```bash
+cd ansible
+./scripts/test-fastpass-deployment.sh
+```
+
+This will check:
+- ✅ Ansible installation
+- ✅ Inventory configuration
+- ✅ Playbook files
+- ✅ Role files
+- ✅ Group variables
+- ✅ Playbook syntax
+- ✅ Common issues
+
+### 2. Deploy the Cluster
+
+```bash
+# Deploy the complete cluster
+ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml
+```
+
+## Deployment Process
+
+The deployment follows this sequence:
+
+### Phase 1: System Preparation
+- **Hosts**: All FastPass nodes
+- **Tasks**: 
+  - Preflight checks (OS, memory, CPU, disk space)
+  - Disable swap and configure kernel modules
+  - Install and configure containerd
+  - Install Kubernetes packages
+
+### Phase 2: Control Plane Initialization
+- **Hosts**: First control plane node (`space-mountain`)
+- **Tasks**:
+  - Initialize the Kubernetes cluster
+  - Configure API server and etcd
+  - Install Flannel CNI
+  - Generate join commands
+
+### Phase 3: Additional Control Plane Nodes
+- **Hosts**: Remaining control plane nodes (`big-thunder-mountain`, `splash-mountain`)
+- **Tasks**:
+  - Join additional control plane nodes
+  - Configure high availability
+
+### Phase 4: Worker Nodes
+- **Hosts**: Worker nodes (`haunted-mansion`, `peter-pans-flight`)
+- **Tasks**:
+  - Join worker nodes to the cluster
+  - Apply node labels and taints
+
+### Phase 5: Validation
+- **Hosts**: First control plane node
+- **Tasks**:
+  - Verify all nodes are ready
+  - Check all pods are running
+  - Display final cluster status
+
+## Configuration
+
+### Inventory Structure
+
+Ensure your `inventory.yml` has the correct structure:
+
+```yaml
+fastpass_control_plane:
+  hosts:
+    space-mountain:
+    big-thunder-mountain:
+    splash-mountain:
+
+fastpass_workers:
+  hosts:
+    haunted-mansion:
+    peter-pans-flight:
+
+fastpass:
+  children:
+    fastpass_control_plane:
+    fastpass_workers:
+```
+
+### Group Variables
+
+Key variables in `group_vars/fastpass/vars`:
+
+```yaml
+# Cluster Configuration
+cluster_name: "fastpass"
+kubernetes_version: "1.33"
+pod_network_cidr: "10.244.0.0/16"
+service_cidr: "10.96.0.0/12"
+
+# Control Plane Configuration
+control_plane_endpoint: "fastpass.local.mk-labs.cloud"
+control_plane_port: "6443"
+
+# CNI Configuration
+cni_plugin: "flannel"
+
+# Node Labels
+node_labels:
+  zone:
+    # Control Plane nodes (masters) - no zone labels needed
+    # space-mountain: (control plane - no zone label)
+    # big-thunder-mountain: (control plane - no zone label)
+    # splash-mountain: (control plane - no zone label)
+    
+    # Worker nodes
+    haunted-mansion: "backstage"      # Internal/backstage workloads
+    peter-pans-flight: "backstage"    # Internal/backstage workloads
+    # Future node: "on-stage"         # External/on-stage workloads (future)
+```
+
+## Troubleshooting
+
+### Common Issues
+
+#### 1. Swap Enabled
+**Problem**: `running with swap on is not supported`
+**Solution**: The playbook automatically disables swap, but if it persists:
+```bash
+# On the problematic node
+sudo swapoff -a
+sudo systemctl restart kubelet
+```
+
+#### 2. CNI Not Ready
+**Problem**: `Network plugin returns error: cni plugin not initialized`
+**Solution**: The playbook installs Flannel automatically. If issues persist:
+```bash
+kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
+```
+
+#### 3. Control Plane Endpoint Issues
+**Problem**: `unable to add a new control plane instance to a cluster that doesn't have a stable controlPlaneEndpoint`
+**Solution**: The playbook uses the first control plane node as the endpoint. For production, consider using a load balancer.
+
+#### 4. Permission Issues
+**Problem**: `User "kubernetes-admin" cannot create resource "secrets"`
+**Solution**: The playbook uses super-admin.conf for proper permissions.
+
+### Debug Commands
+
+```bash
+# Check node status
+kubectl get nodes -o wide
+
+# Check pod status
+kubectl get pods --all-namespaces
+
+# Check kubelet logs
+journalctl -u kubelet -f
+
+# Check API server logs
+kubectl logs -n kube-system kube-apiserver-space-mountain
+
+# Check CNI status
+kubectl get pods -n kube-flannel
+```
+
+## Post-Deployment
+
+### 1. Verify Cluster Health
+
+```bash
+# Check all nodes are ready
+kubectl get nodes -o wide
+
+# Check all pods are running
+kubectl get pods --all-namespaces
+
+# Test cluster connectivity
+kubectl cluster-info
+```
+
+### 2. Manage Kubeconfig
+
+Use the provided script to manage different cluster configurations:
+
+```bash
+# Switch to FastPass cluster
+./scripts/manage-kubeconfigs.sh fastpass
+
+# Check status
+./scripts/manage-kubeconfigs.sh status
+
+# Test connectivity
+./scripts/manage-kubeconfigs.sh test
+```
+
+### 3. Deploy Applications
+
+Your cluster is now ready for workloads:
+
+```bash
+# Deploy a test application
+kubectl run nginx --image=nginx --port=80
+
+# Create a service
+kubectl expose pod nginx --port=80 --type=NodePort
+
+# Check the service
+kubectl get svc nginx
+```
+
+## Maintenance
+
+### Adding New Nodes
+
+1. Add the new node to the inventory
+2. Run the preparation role:
+   ```bash
+   ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml --limit=new-node
+   ```
+3. Join the node to the cluster manually or extend the playbook
+
+### Upgrading Kubernetes
+
+1. Update the `kubernetes_version` variable
+2. Run the preparation role on all nodes
+3. Upgrade control plane nodes first
+4. Upgrade worker nodes
+
+### Backup and Recovery
+
+- Backup `/etc/kubernetes/` directory on control plane nodes
+- Backup etcd data: `etcdctl snapshot save backup.db`
+- Document cluster configuration
+
+## Architecture
+
+```
+FastPass Cluster Architecture:
+┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
+│  Control Plane  │    │  Control Plane  │    │  Control Plane  │
+│  space-mountain │    │big-thunder-mtn  │    │ splash-mountain │
+│   (Masters)     │    │   (Masters)     │    │   (Masters)     │
+│  No Zone Label  │    │  No Zone Label  │    │  No Zone Label  │
+└─────────────────┘    └─────────────────┘    └─────────────────┘
+         │                       │                       │
+         └───────────────────────┼───────────────────────┘
+                                 │
+         ┌───────────────────────┼───────────────────────┐
+         │                       │                       │
+┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
+│   Worker Node   │    │   Worker Node   │    │   Worker Node   │
+│ haunted-mansion │    │peter-pans-flight│    │  (Future)       │
+│   (Backstage)   │    │   (Backstage)   │    │   (On-Stage)    │
+│ zone=backstage  │    │ zone=backstage  │    │ zone=on-stage   │
+└─────────────────┘    └─────────────────┘    └─────────────────┘
+```
+
+## Support
+
+For issues specific to this deployment:
+1. Check the troubleshooting section
+2. Review Ansible logs with `-vvv` verbosity
+3. Check system logs on affected nodes
+4. Verify network connectivity between nodes
+
+## Files Structure
+
+```
+ansible/
+├── group_vars/
+│   └── fastpass/
+│       └── vars                    # Cluster configuration
+├── playbooks/
+│   ├── deploy-fastpass-cluster.yml # Main deployment playbook
+│   ├── deploy_k8s.yml             # Legacy deployment playbook
+│   └── roles/
+│       ├── kubernetes/             # System preparation
+│       ├── fastpass-control-plane/ # Control plane setup
+│       ├── fastpass-control-plane-join/ # Additional control plane nodes
+│       └── fastpass-workers/       # Worker node setup
+├── scripts/
+│   ├── test-fastpass-deployment.sh # Validation script
+│   └── manage-kubeconfigs.sh      # Kubeconfig management
+└── inventory.yml                   # Host inventory
+``` 

ansible/FASTPASS_README.md

@@ -0,0 +1,228 @@
+# FastPass Kubernetes Cluster - Fedora Deployment Guide
+
+## Overview
+
+This guide covers the deployment of a Kubernetes cluster on Fedora using Ansible automation. The FastPass cluster is designed for high availability with multiple control plane nodes and worker nodes.
+
+## Architecture
+
+```
+FastPass Cluster Architecture:
+┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
+│  Control Plane  │    │  Control Plane  │    │  Control Plane  │
+│  space-mountain │    │big-thunder-mtn  │    │ splash-mountain │
+│   (Leader)      │    │                 │    │                 │
+└─────────────────┘    └─────────────────┘    └─────────────────┘
+         │                       │                       │
+         └───────────────────────┼───────────────────────┘
+                                 │
+         ┌───────────────────────┼───────────────────────┐
+         │                       │                       │
+┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
+│   Worker Node   │    │   Worker Node   │    │   Worker Node   │
+│ haunted-mansion │    │peter-pans-flight│    │  (Future)       │
+│   (backstage)   │    │   (backstage)   │    │                 │
+└─────────────────┘    └─────────────────┘    └─────────────────┘
+```
+
+## Prerequisites
+
+### System Requirements
+- **OS**: Fedora 38+ (64-bit)
+- **Memory**: Minimum 2GB RAM per node
+- **CPU**: Minimum 2 cores per node
+- **Storage**: Minimum 10GB free space
+- **Network**: All nodes must be able to communicate
+
+### Software Requirements
+- Ansible 2.15+
+- Python 3.8+
+- SSH access to all nodes with sudo privileges
+
+## Quick Start
+
+### 1. Prepare Inventory
+
+Ensure your `inventory.yml` has the correct host groups:
+
+```yaml
+fastpass_control_plane:
+  hosts:
+    space-mountain:
+    big-thunder-mountain:
+    splash-mountain:
+
+fastpass_workers:
+  hosts:
+    haunted-mansion:
+    peter-pans-flight:
+
+fastpass:
+  children:
+    fastpass_control_plane:
+    fastpass_workers:
+```
+
+### 2. Configure Variables
+
+Edit `group_vars/fastpass/vars` to customize your deployment:
+
+```yaml
+# Cluster Configuration
+cluster_name: "fastpass"
+kubernetes_version: "1.33"
+pod_network_cidr: "10.244.0.0/16"
+service_cidr: "10.96.0.0/12"
+
+# Node Labels
+node_labels:
+  zone:
+    space-mountain: "external"
+    big-thunder-mountain: "external"
+    splash-mountain: "external"
+    haunted-mansion: "internal"
+    peter-pans-flight: "internal"
+```
+
+### 3. Deploy the Cluster
+
+```bash
+# Deploy the complete cluster
+ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml
+
+# Or deploy step by step
+ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml
+```
+
+## Deployment Process
+
+### Phase 1: System Preparation
+- Preflight checks (OS, memory, CPU, disk space)
+- Disable swap and configure kernel modules
+- Install and configure containerd
+- Install Kubernetes packages
+
+### Phase 2: Control Plane Setup
+- Initialize the first control plane node
+- Configure API server and etcd
+- Install Calico CNI
+- Join additional control plane nodes
+
+### Phase 3: Worker Node Setup
+- Join worker nodes to the cluster
+- Apply node labels and taints
+- Verify cluster health
+
+## Troubleshooting
+
+### Common Issues
+
+#### 1. Repository Errors
+**Problem**: Docker CE repository not found
+**Solution**: Update the repository URL in `container-runtime.yml`:
+```yaml
+baseurl: "https://download.docker.com/linux/fedora/{{ ansible_distribution_major_version }}/x86_64/stable"
+```
+
+#### 2. kubeadm Init Failures
+**Problem**: kubeadm init fails with preflight errors
+**Solution**: The playbook includes `--ignore-preflight-errors=all` flag
+
+#### 3. Node Not Ready
+**Problem**: Worker nodes stuck in NotReady state
+**Solution**: Check CNI installation and network connectivity
+
+### Debug Commands
+
+```bash
+# Check node status
+kubectl get nodes -o wide
+
+# Check pod status
+kubectl get pods --all-namespaces
+
+# Check kubelet logs
+journalctl -u kubelet -f
+
+# Check containerd status
+systemctl status containerd
+```
+
+## Customization
+
+### Network Configuration
+Modify the pod and service CIDRs in `group_vars/fastpass/vars`:
+
+```yaml
+pod_network_cidr: "10.244.0.0/16"
+service_cidr: "10.96.0.0/12"
+```
+
+### CNI Selection
+The default CNI is Calico. To change, modify the control plane role:
+
+```yaml
+cni_plugin: "flannel"  # or "weave", "cilium"
+```
+
+### Node Labels and Taints
+Configure node labels in `group_vars/fastpass/vars`:
+
+```yaml
+node_labels:
+  zone:
+    space-mountain: "external"
+    haunted-mansion: "internal"
+  environment: "production"
+  cluster: "fastpass"
+```
+
+## Maintenance
+
+### Adding New Nodes
+1. Add the new node to the inventory
+2. Run the preparation role: `ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml --limit=new-node`
+3. Join the node to the cluster
+
+### Upgrading Kubernetes
+1. Update the `kubernetes_version` variable
+2. Run the preparation role on all nodes
+3. Upgrade control plane nodes first
+4. Upgrade worker nodes
+
+### Backup and Recovery
+- Backup `/etc/kubernetes/` directory on control plane nodes
+- Backup etcd data: `etcdctl snapshot save backup.db`
+- Document cluster configuration
+
+## Security Considerations
+
+- SELinux is set to permissive mode for compatibility
+- Firewalld is disabled (configure as needed for your environment)
+- Consider enabling RBAC and network policies
+- Regularly update Kubernetes and system packages
+
+## Support
+
+For issues specific to this deployment:
+1. Check the troubleshooting section
+2. Review Ansible logs with `-vvv` verbosity
+3. Check system logs on affected nodes
+4. Verify network connectivity between nodes
+
+## Files Structure
+
+```
+ansible/
+├── group_vars/
+│   └── fastpass/
+│       └── vars                    # Cluster configuration
+├── playbooks/
+│   ├── deploy-fastpass-cluster.yml # Main deployment playbook
+│   ├── deploy_k8s.yml             # Legacy deployment playbook
+│   └── roles/
+│       ├── kubernetes/             # System preparation
+│       ├── fastpass-control-plane/ # Control plane setup
+│       └── fastpass-workers/       # Worker node setup
+└── inventory.yml                   # Host inventory
+``` 

ansible/KUBECONFIG_MANAGEMENT.md

@@ -0,0 +1,233 @@
+# Kubeconfig Management - Modular & Repeatable
+
+This document explains the modular kubeconfig management system for your homelab's multiple Kubernetes clusters.
+
+## Overview
+
+The kubeconfig management has been refactored into reusable, modular components that can handle multiple clusters seamlessly:
+
+- **FastPass** (Vanilla Kubernetes)
+- **Hub Cluster** (OpenShift SNO)
+- **Internal Cluster** (OpenShift)
+- **Future clusters** (easily extensible)
+
+## Architecture
+
+```
+ansible/playbooks/roles/
+├── kubeconfig-manager/          # Core reusable role
+│   ├── tasks/main.yml          # Main entry point
+│   ├── tasks/merge-kubeconfig.yml  # Merging logic
+│   ├── defaults/main.yml       # Default variables
+│   └── README.md               # Role documentation
+├── cluster-kubeconfig/         # Generic wrapper role
+└── fastpass-first-control-plane/  # Uses kubeconfig-manager
+```
+
+## Quick Usage
+
+### 1. Using the Script (Easiest)
+
+```bash
+cd ansible
+
+# Setup FastPass cluster kubeconfig
+./scripts/setup-kubeconfig.sh fastpass fastpass_control_plane[0]
+
+# Setup Hub cluster kubeconfig  
+./scripts/setup-kubeconfig.sh hub hub_cluster
+
+# Setup Internal cluster kubeconfig
+./scripts/setup-kubeconfig.sh internal internal_cluster[0]
+```
+
+### 2. Direct Ansible Usage
+
+```bash
+# Single cluster
+ansible-playbook -i inventory.yml \
+  playbooks/examples/multi-cluster-kubeconfig.yml \
+  --limit fastpass_control_plane[0] \
+  -e target_cluster_name=fastpass
+
+# Multiple clusters at once
+ansible-playbook -i inventory.yml \
+  playbooks/examples/multi-cluster-kubeconfig.yml
+```
+
+### 3. In Your Own Playbooks
+
+```yaml
+- name: Setup kubeconfig for any cluster
+  hosts: my_cluster_nodes[0]
+  roles:
+    - role: kubeconfig-manager
+      vars:
+        cluster_name: "my-cluster"
+        kubeconfig_source_path: "/etc/kubernetes/admin.conf"
+```
+
+## Features
+
+### ✅ **Modular & Reusable**
+- Single role works with any Kubernetes cluster
+- Easy to extend for new clusters
+- Consistent behavior across all clusters
+
+### ✅ **Safe Operations**
+- Automatic backups before merging
+- Non-destructive merging
+- Preserves existing contexts
+
+### ✅ **Multi-Cluster Ready**
+- Unique naming: `cluster-name-admin`
+- No conflicts between clusters
+- Easy context switching
+
+### ✅ **Homelab Optimized**
+- Works with vanilla Kubernetes
+- Works with OpenShift
+- Handles different kubeconfig paths
+
+## Generated Structure
+
+After running the kubeconfig management:
+
+```bash
+~/.kube/
+├── config                      # Merged config with all clusters
+├── config-fastpass            # Individual cluster configs
+├── config-hub
+├── config-internal
+└── config.backup.1697123456   # Timestamped backups
+```
+
+## Context Management
+
+```bash
+# List all available contexts
+kubectl config get-contexts
+
+# Switch between clusters
+kubectl config use-context fastpass-admin
+kubectl config use-context hub-admin
+kubectl config use-context internal-admin
+
+# Check current context
+kubectl config current-context
+
+# Test connectivity
+kubectl cluster-info
+kubectl get nodes
+```
+
+## Integration with Existing Roles
+
+### Before (Monolithic)
+```yaml
+# fastpass-first-control-plane/tasks/main.yml
+- name: 50+ lines of kubeconfig logic
+  # Lots of repetitive code
+```
+
+### After (Modular)
+```yaml
+# fastpass-first-control-plane/tasks/main.yml
+- name: Setup kubeconfig for FastPass cluster
+  ansible.builtin.include_role:
+    name: kubeconfig-manager
+  vars:
+    cluster_name: "{{ cluster_name }}"
+```
+
+## Adding New Clusters
+
+To add a new cluster (e.g., "edge-cluster"):
+
+1. **Add to inventory:**
+```yaml
+edge_cluster:
+  hosts:
+    edge-node-01:
+```
+
+2. **Use the script:**
+```bash
+./scripts/setup-kubeconfig.sh edge edge_cluster[0]
+```
+
+3. **Or add to playbook:**
+```yaml
+- name: Setup kubeconfig for Edge cluster
+  hosts: edge_cluster[0]
+  roles:
+    - role: kubeconfig-manager
+      vars:
+        cluster_name: "edge"
+```
+
+## Customization
+
+### Different Kubeconfig Paths
+```yaml
+- role: kubeconfig-manager
+  vars:
+    cluster_name: "openshift-cluster"
+    kubeconfig_source_path: "/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig"
+```
+
+### Custom Context Names
+```yaml
+- role: kubeconfig-manager
+  vars:
+    cluster_name: "prod"
+    context_suffix: "system:admin"  # Results in "prod-system:admin"
+```
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Permission Denied**
+   ```bash
+   # Fix ownership
+   sudo chown -R $USER:$USER ~/.kube/
+   ```
+
+2. **Context Not Found**
+   ```bash
+   # List available contexts
+   kubectl config get-contexts
+   
+   # Check if cluster was added
+   kubectl config view
+   ```
+
+3. **Backup Recovery**
+   ```bash
+   # Restore from backup
+   cp ~/.kube/config.backup.1697123456 ~/.kube/config
+   ```
+
+### Debug Mode
+```bash
+# Run with verbose output
+ansible-playbook -vvv playbooks/examples/multi-cluster-kubeconfig.yml
+```
+
+## Benefits for Your Homelab
+
+1. **Consistency**: Same process for all clusters
+2. **Maintainability**: Single role to update/fix
+3. **Scalability**: Easy to add new clusters
+4. **Safety**: Automatic backups and safe merging
+5. **Flexibility**: Works with different Kubernetes distributions
+
+## Next Steps
+
+1. **Test the modular approach** with your FastPass cluster
+2. **Extend to Hub and Internal clusters** using the same pattern
+3. **Create cluster-specific variables** in group_vars if needed
+4. **Add monitoring/validation** tasks to verify kubeconfig health
+
+This modular approach makes your homelab's multi-cluster management much more maintainable and repeatable!

ansible/group_vars/all/vars

@@ -0,0 +1,20 @@
+---
+# file: group_vars/all
+
+# Proxmox variables
+proxmox_user: "root@pam"
+proxmox_password: "{{ vault_proxmox_root_password }}"
+proxmox_host: "main-street-usa.local.mk-labs.cloud"
+
+# DNS variables
+dns_server: "monorail" # .local.mk-labs.cloud"
+#dns_admin: "admin"
+base_domain: "local.mk-labs.cloud"
+# DHCP server
+#dhcp_server: "matchbox"
+
+# Terraform variables
+terraform_server: "infra01"
+
+# Traefik variables
+traefik_server: "lightning-lane"

ansible/group_vars/all/vault

@@ -0,0 +1,170 @@
+$ANSIBLE_VAULT;1.1;AES256
+64393362643437353731353234643535366431613861636131613139636435633465306333656161
+3365306632386330373862363637363435633235643336610a663736396537313032336162633334
+32626233346233323565383030393130316532653062373730376163326134616239663865363862
+3365316365643534610a343932623566356637663136336338386534373532383863363662326438
+37393331356632313163643138613330366631643465623633386433663236636334666264383033
+34333935633131363364626333313336353733373562326636343633653838616532643737366435
+36366330633263613938323566393063373233363538643531636131316335316461656631616362
+30343965356363383139366534363664313831363132383337636266316538393139383232386230
+65353364313534333632306465393264386466346365303232356263653563653338306131376131
+66343764643639396663623330623332333466633737343738386230626463386137373536343430
+36636430616132363161303338353033343963643338656639643662636664613965636263366135
+64353134376162633162316166316239333963653930363830646165636537653238623537323238
+39376338636335336338323935333439306534386539336331613961663261623962383237303632
+34326139626366303331363337353432623636626231373731646665623831353865303130663533
+37326639626237653361316666616161363531303961613538636663633063396363346337663239
+64313333653766383736303161636530316538633033323063323662336335666264646564643465
+64396436366131373061326233643562626335376263623031376532313730653363343038356135
+30336131646635636638353934636139343662623265336338386535663536393935343132306335
+33626632613663353661313061623732643539323637336433666330313463666661623836303462
+61383732613139343434363662616539373837633139393764353864613062346237346661633033
+61393639326535366266643664653439383238646132306636656130333733316638363830346433
+38643430346263663639653762393935356662363533323766343362366532626532633530323630
+30643436653130363066373665666434383732663837643839356539366432316539613863623839
+35323930383437383535373330326239663966383234663233643337623330353236626464636530
+36393735646664366235363831656262383333626265383066393363346165656265363438306135
+34633530653837346638636665666162363062663333623263356131646661373234333939333536
+30643639333836373439613561346130623239363737626238663436356365633562366465643561
+32643039376234323963653733353138643138626430383639313765353035646539653466623539
+32366135366266323261333938373837386636626232323661393035613638643335383564663462
+31383663663063373935396439653231353962303630346338623938343064643037396562626637
+63363363343739626639633934393734396434653262373137373539316536306663336466626639
+34646465306439313239323365333761663161313461613766343463666134303036376338366663
+64356364653462383534343438343933623766396232336434653765613864376235363735343032
+32313133383731333366626534363065333738346230393636393938366633363561346436363338
+33393932626333636166313431633339386564616466653165383962656633303161393935366635
+65396464326333396433303966316231376432363335643732303438663131653932636564363264
+36356663623436643835373538363662643134313030656236326335393334626634663136333137
+38363432346663393435366536636335636465343131666562396334636530346235366365396431
+64623739373130623436356161666139656330646661396430633264393632663366353037643130
+35373839373430643065616630613433646536356563353133633361623235623733313234306435
+64356635343361633462376131636362386433373339383365313436333332613333316237323632
+33633362376331323930376130393838633333316330363362396131306230643161373636303034
+37303738306233363937316332313830396336323639333634666364633566386261373031383563
+36633865643634363234613463636437306236376435613034623537356162353235396665636338
+31613733363430313532643235343438393137313136653730643364623662336236323464656465
+65636431633464613437396561643638346565313937303731633837623930333538383335633938
+62666461323033303937653366646432623764653566626333333766656235633662623631636636
+35626161653736303261303233643236393038303063386532643563663065303331616637386661
+33326637393633616430643665623431616336336666383236326538383535633364613135653131
+38383961383264313130383263613763326666663033626338313762376336353866646634323537
+39393565643265633437396535643165626165646537373039613061613936356434366238636562
+61393639316531316564646334663863383836656261623230646461323566316664653965336136
+62353839363664396632306231363031303265343131343739633835353338386335343737326633
+36656433616135653663353166636461623337653138613435646663663939323631373063373136
+63396331313538636437383635643831643935303932313964336532643366623434316662376632
+63666464333736333162373461333563393138366638643039393865613238616531356165346236
+65313432383533353738396530356465386263313939393962333637306138653939646638353235
+37393733333032623763333632353866633866613162663833346534666237383430663838383965
+66663332616164353539323261383364363237383064306132633530326134383561346536346636
+32393365316435626464386631663037663934313533663030313466323134336439303362626365
+30613764346362326130353333353663316539306437376465306332353464343530663933363562
+39646333323631353835336461326233623963353535316633353236353236636462313163633638
+35366538366336663534353739353231306164626664383737333565666337636164386539316632
+64323966336637626538303830323535373533306362636236303065663161353734653633393064
+66353938306238646238313037323163343935643863653632336462363834326634363433383338
+35646364353834376439633136313939393064633539643462623562333832303261386331636533
+37373837396461373064353565353438633938616162363138323561343662383330346633323133
+36626665343636343739353732366133313434623230353732323037633236303237656364323763
+30363530306131303630386131623866323861633636313431376161336536373436656334303036
+61316639666136313338396233326234386634343863633632626264363336376531363461626564
+35336335396561626339616234373265663032353432363832306666353339376338396366383839
+62633063326135323539653133626538613331613334353430623232376336633334666433316638
+61326563366432333632666436363761376237636434356231613061626633303737626531626236
+62373166363432616666616630616565373934356564363266396662323963636434313735626161
+61373738623966363032313632376465356235363834633639663733653131636531363563326662
+62663365323934363761653536356162336463646566393838346134356536303264323065396534
+63346531303764613634646336313530326663373433396436663162343530306131386265303137
+32333432383966363735343331646233613631373165346131323632366165346235656330323939
+34393030313466666265346163323561353734613434386239333630623762616566616562316265
+38633263323339396462336166646431363336616462366463383663313839613638383663303133
+32333835623531366236643530623961656631336139313037353962323937666465343430666336
+33383464363930663630333164636361326334396163376661666564663538623732663839613237
+35623237613761356235383130633733333766333236363537383862306539373665383461386534
+32646432363339306433646139393732366464336339346161323736363937383566656663356230
+65316562383562366366653466646461613235353061623363386331636139386136306131633232
+32326238353861613236373964383131363537653632663532376364336166303662663336623161
+37623838616664376561663763393534323931343163376535396662626333383730363232653036
+39626266623666346635373630343135333532353866363234396265356631333265663432326235
+37346439613363313334633964386632336138316662616661356637363730306164646439643765
+62343137663137633031316665363362643165643731326464323962616330383164353861366462
+31663965626338636534356461366362333831396464376134613331393664306639386632396236
+66633066663831646361333730356361646133383834376230356336613038303665323732663162
+37643130313739306638636262656632353431316531336438363636363833626237346363326461
+31636262396632666335303566633161333937626330373835613236656130383132663863636364
+34383661353966346362386461303062303138626536323163376362326639356336396437333530
+66623765313638616430383838396164336565646338636430363262396636663965383531383139
+35356663363437383132333566336131666139643639663662633363616133323031353032663438
+39393266633639306363313530643239303132303264323063306335346233363233373865653863
+65396430346630626566383963356264313630623336316236393730343437656435656664663266
+32643639363536396266626435373363303234623230383035326536633631633737653739366563
+65653932663539353436366139313635663962663330343461353864323166323733366163653162
+66353866376134633534323366656265633930356132316137616235343866653265666161363266
+30386638343739353965643466613639303666316432323634383464633431363566333831643134
+65363138313439366430613837396337323436636530313664303964353966306565663630323662
+33643639623935336235373332633739306539656235323439343331376632373538613534386430
+30633832656532623262326662376237393262333764623937343232383861636563633730393765
+39663032373132323735633361343933333332623465343863636263363161303165656234313338
+65383462626465376162306639626531366161396531643364656539366233306166386234313761
+30633666303832636561323236373363373137353032613637353637386238353234646431333661
+32313834666237626333626437663562646438363561393364373565313536363535323536363537
+35633834616136656261643130656131306264333131326431626439343765393031313964616639
+33643933653033336436616635346335383335333334343836343638613264396462633530623866
+30303462653130353430663862623261343866383335343239393435633962383864396430313536
+66643535303437383232323564326266356636376464623563636139633237313661356330633931
+66376631373366613731633863666132626366393532666331343361323764626539666238656262
+66356332383235353864303562356638636130343938383530376432663866316238333434616233
+32316432333064663764363831343464326334353737346632383565643737366233396139333639
+35656435346335323030636363356633633332376138653930613037313537373038353433363532
+39346161336261353463656430663033623036396365346638323832313361633866363134396165
+65356632366463393435386366643232383162623536653965643235323934633464373061333237
+32636564386662626365613235333664323563633466383238343336343063376531396161343530
+61306632646133626133343132666534666337336239306137663931623637643164326538646138
+63313037336235316164316232636262316331356363356438653235346539643065636537366661
+37313437386432316336663366633366666434346135356462623635313531333530653866663863
+31646438316435373637303733646564316261336233623035353564363664303437373132353166
+33646534663130356330663565656663333765653961663835623235633665623464353862616138
+37343531366462616439333539306265626164636233616262616563386566396536386264343137
+30396434303231366664656334656635616334633066323062313738363431646335643132626331
+33663038316165626365346366363731323639653837616163653561623034393064303563353232
+30613939353336396365613662393938663933363662656634663465303134393964623738633765
+37633832626631363736383436666263356531366237356261666538303863343033356333656138
+64366537363939346535313732643965623332396265386636353364316630333130643833383331
+34643563386539383235386130323065353835376564613835313934333636316464636463376537
+32363565333038643230656266393761313064616537393830343163643535646436616230626166
+36373531646536363664663330353864636533656261353331316364633361633934326436323933
+39636631623430313934393033373630656132623734363835353735353935393063356261323764
+66346265376339623265376666343865343763393833323564643161613861303065346137653339
+34326432383230656638303963373832316438666131623539613464636631653365353331346262
+37626130343831636133646135323564306538353439636265313239326235343232633136383663
+62306561616564623038393631373862346535366135633836353363323330346430613466393463
+39313766613064306566316561303761626135613063326536363761626635646134303732356130
+38333266363639636565393737323938663938633662653231366164316262666538356162323665
+38383263366133326333636466343835373737613333623464383139343863336234373932393239
+36653736393732353466656334613364626339356533343363353731353033363730376565353236
+66343332306330303662373363326236393333663565383661643763363662396265313037643432
+63343336623663326237326365333565346335346630356439303534363561626362363833313239
+62366436313466633534343430306461313266376363336536666162306135363434643266373338
+65323866323537636465306636646533316466303735386336663234386538303939343661653562
+34353564313738643665636337336536343735336436626438653335376532343137613837356363
+31353861363733373232363865323164663532646235623533336536333932363133613830373937
+38616137646332303934303839633336313239653064626331383432633935353538636132633134
+61393230663536633335393330386363333162636661373938343837323736663539393636366532
+35623637623262373332373335303833373239323430393766633939633665643236623139363834
+30636135303634643765393433393962303138666630343936653234333730336234356234396566
+35346331336639333237323136616337623938666561343861393563393633313261633333333434
+38633064633538396566373730636632346234653339303533343431643266373266633836633139
+33313234366236626338636331346565336138313136623632343735363132623964353066346233
+66363833383432316238353364363963323762666562303030663939303162656261663664616632
+66396466643763393130313831313438356635346230646335306237363262366132323133646535
+30313338653262636136393133306663653331333830626534356536303532633031356435663734
+32383035643637313863653537656665366138333933333364646561353333653661306133646361
+32326535393333383033313765383031353233323138386365623132646636383037633537386361
+65306166613030353033666438343530333330306532323135306363653764613638383461633964
+63666239366638663537643636373432303164623735626634383636643836343436346161393365
+62336462636534383766656632653833333832393263316633356235373335643436363333393335
+62643838303131643265613861373964653464623766363664383330343138653632396365633533
+39383535616630663564326536623537323966616436353439343630363738626131326365656132
+32383737303733623830353366383062313134396531303831323336326137396335353763353631
+36663336353865303562316233643762643563386665393664623138643836633165

ansible/group_vars/fastpass/vars

@@ -0,0 +1,66 @@
+---
+# FastPass Kubernetes Cluster Variables
+
+# Cluster Configuration
+cluster_name: "fastpass"
+kubernetes_version: "1.33"
+pod_network_cidr: "10.244.0.0/16"
+service_cidr: "10.96.0.0/12"
+
+# Control Plane Configuration
+control_plane_endpoint: "{{ cluster_name}}.{{ base_domain}}"
+control_plane_port: "6443"
+
+# CNI Configuration
+cni_plugin: "calico"
+calico_version: "v3.30.3"
+
+# Node Labels and Taints
+node_labels:
+  zone:
+    # Control Plane nodes (masters) - no zone labels needed
+    # space-mountain: (control plane - no zone label)
+    # big-thunder-mountain: (control plane - no zone label)
+    # splash-mountain: (control plane - no zone label)
+    
+    # Worker nodes
+    haunted-mansion: "backstage"      # Internal/backstage workloads
+    peter-pans-flight: "backstage"    # Internal/backstage workloads
+    # Future node: "on-stage"         # External/on-stage workloads (future)
+  
+  environment: "production"
+  cluster: "fastpass"
+
+# System Configuration
+selinux_mode: "permissive"
+firewall_enabled: false
+
+# Container Runtime
+container_runtime: "containerd"
+containerd_version: "latest"
+
+# Repository Configuration
+kubernetes_repo_url: "https://pkgs.k8s.io/core:/stable:/v1.33/rpm/"
+containerd_repo_url: "https://download.docker.com/linux/fedora/docker-ce.repo"
+
+# Validation
+preflight_checks: true
+validate_cluster: true
+
+# Kubeconfig Configuration
+kubeconfig_path: "{{ lookup('env', 'HOME') }}/.kube/config"
+
+# Hostname Configuration for Kubernetes
+# Override hostnames to remove dots for Kubernetes compatibility
+kubernetes_hostnames:
+  space-mountain: "space-mountain"
+  big-thunder-mountain: "big-thunder-mountain"
+  splash-mountain: "splash-mountain"
+  haunted-mansion: "haunted-mansion"
+  peter-pans-flight: "peter-pans-flight"
+
+# Generic Kubernetes Prerequisites Configuration
+configure_firewall: true
+configure_ntp: true
+selinux_state: "permissive"
+disable_swap: true 

ansible/group_vars/hub_cluster/vars

@@ -0,0 +1,51 @@
+# file: group_vars/hub_cluster/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Name of the OpenShift Cluster
+
+cluster_name: "hub"
+
+# Version of OpenShift to install.  All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
+
+cluster_version: "4.18.21"
+
+# Type of cluster. 
+# - none (Single Node Cluster)
+# - baremetal (Traditional and Compact Cluster)
+
+platform_type: "none"
+
+# Number of nodes to deploy
+# - Master: 1; Worker 0 (Single Node Cluster)
+# - Master: 3; Worker 0 (Compact Cluster)
+# - Master: 3; Worker 1-3 (Traditional Cluster)
+
+master_node_count: 1
+worker_node_count: 0
+
+# Subnet that cluster nodes will reside on.
+
+machine_network: "10.1.71.0/24"
+
+# OpenShift API IP Address (Reference host IP address for Single Node Cluster)
+
+api_address: "{{ ip_address }}" # "10.1.71.10"
+
+# OpenShift Apps Wildcard IP Address (Reference host IP address for Single Node Cluster)
+
+app_address: "{{ ip_address }}" # "10.1.71.10"
+
+# These are internal networks to the cluster and should not need to be changed.
+
+cluster_network: "10.128.0.0/14"
+cluster_network_host_prefix: 23
+service_network: "172.30.0.0/16"
+
+# Static Variables
+
+openshift_installer_file: "openshift-install-linux.tar.gz"
+openshift_client_file: "openshift-client-linux.tar.gz"
+openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
+openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

ansible/group_vars/internal_cluster/vars

@@ -0,0 +1,51 @@
+# file: group_vars/internal_cluster/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Name of the OpenShift Cluster
+
+cluster_name: "openshift"
+
+# Version of OpenShift to install.  All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
+
+cluster_version: "4.18.21"
+
+# Type of cluster. 
+# - none (Single Node Cluster)
+# - baremetal (Traditional and Compact Cluster)
+
+platform_type: "baremetal"
+
+# Number of nodes to deploy
+# - Master: 1; Worker 0 (Single Node Cluster)
+# - Master: 3; Worker 0 (Compact Cluster)
+# - Master: 3; Worker 1-3 (Traditional Cluster)
+
+master_node_count: 3
+worker_node_count: 1
+
+# Subnet that cluster nodes will reside on.
+
+machine_network: "10.1.71.0/24"
+
+# OpenShift API IP Address
+
+api_address: "10.1.71.69"
+
+# OpenShift Apps Wildcard IP Address (These will be the same in a Single Node Cluster)
+
+app_address: "10.1.71.60"
+
+# These are internal networks to the cluster and should not need to be changed.
+
+cluster_network: "10.128.0.0/14"
+cluster_network_host_prefix: 23
+service_network: "172.30.0.0/16"
+
+# Static Variables
+
+openshift_installer_file: "openshift-install-linux.tar.gz"
+openshift_client_file: "openshift-client-linux.tar.gz"
+openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
+openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

ansible/group_vars/ipaserver/vars

@@ -0,0 +1,4 @@
+---
+#freeipa_user: "admin"
+ipaadmin_password: "{{ vault_freeipa_password }}"
+ipaserver_domain: "int.mk-labs.cloud"

ansible/group_vars/ntp_servers/vars

@@ -0,0 +1,18 @@
+---
+# file: group_vars/ntp_servers/vars
+#Ansible vars template for NTP servers.
+
+ntp_servers:
+  - 0.us.pool.ntp.org
+  - 1.us.pool.ntp.org
+
+allowed_networks:
+  - "192.168.1.0/24"
+  - "192.168.2.0/24"
+  - "192.168.3.0/24"
+  - "192.168.5.0/24"
+  - "192.168.9.0/24"
+  - "192.168.10.0/24"
+  - "192.168.250.0/24"
+  - "10.1.71.0/24"
+  - "10.1.82.0/24"

ansible/group_vars/openshift_cluster_template/vars

@@ -0,0 +1,54 @@
+# file: group_vars/openshift_cluster_template/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+# Name of the OpenShift Cluster
+
+cluster_name: "openshift"
+
+# Version of OpenShift to install.  All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
+
+cluster_version: "4.18.21"
+
+# Type of cluster. 
+# - none (Single Node Cluster)
+# - baremetal (Traditional and Compact Cluster)
+
+platform_type: "baremetal"
+
+# Number of nodes to deploy
+# - Master: 1; Worker 0 (Single Node Cluster)
+# - Master: 3; Worker 0 (Compact Cluster)
+# - Master: 3; Worker 1-3 (Traditional Cluster)
+
+master_node_count: 3
+worker_node_count: 1
+
+# Subnet that cluster nodes will reside on.
+
+machine_network: "10.1.71.0/24"
+
+# OpenShift API IP Address (Comment out for Single Node Cluster)
+
+api_address: "10.1.71.69"
+
+# OpenShift Apps Wildcard IP Address (Comment out for Single Node Cluster)
+
+app_address: "10.1.71.60"
+
+# These are internal networks to the cluster and should not need to be changed.
+
+cluster_network: "10.128.0.0/14"
+cluster_network_host_prefix: 23
+service_network: "172.30.0.0/16"
+
+# Static Variables
+
+openshift_installer_file: "openshift-install-linux.tar.gz"
+openshift_client_file: "openshift-client-linux.tar.gz"
+openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
+openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

ansible/group_vars/prometheus_server/vars

@@ -0,0 +1,34 @@
+# file: group_vars/prometheus_server/vars
+# Ansible vars template for Prometheus nodes created via Ansible\.
+
+# Version of Prometheus to install.  All available versions can be found at: https://prometheus.io/download/
+
+#prometheus_version: "3.5.0"
+#alertmanager_version: "0.28.1"
+
+# prometheus_nodes:
+# #  - '192.168.1.207'  # Worker node IP
+#   - cinderella-castle  # Master node IP 
+#   - 10.1.71.21
+#   - cinderella-castle.local.mk-labs.cloud
+
+# Static Variables
+# prometheus_installer_file: "prometheus-{{ prometheus_version }}.linux-amd64.tar.gz"
+# prometheus_installer_download_url: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/{{ prometheus_installer_file }}"
+
+# Grafana Variables
+
+#grafana_port: "3000"
+#grafana_url: "{{ inventory_hostname }}.{{ base_domain }}:3000"
+
+# prometheus_targets:
+#   node:
+#   - targets:
+#     - localhost:9100
+#     labels:
+#       env: mk-labs
+
+grafana_ini:
+  security:
+    admin_user: admin
+    admin_password: admin

ansible/group_vars/unbound_servers/vars.yml

@@ -0,0 +1,77 @@
+---
+# Variables for Unbound https://github.com/aruhier/ansible-role-unbound
+
+### Server ###
+
+unbound_chroot: '""'
+unbound_num_threads: 2
+unbound_interfaces:
+  - "{{ ip_address }}"
+#unbound_do_ip4: "yes"
+unbound_do_ip6: "no"
+#unbound_do_udp: "yes"
+#unbound_do_tcp: "yes"
+
+# list of strings, as the order impact how policies are interpreted
+unbound_outgoing_policies: []
+
+unbound_access_control:
+  - '192.168.1.0/24 allow'
+  - '192.168.3.0/24 allow'
+  - '192.168.5.0/24 allow'
+  - '192.168.10.0/24 allow'
+  - '10.1.71.0/24 allow'
+  
+unbound_access_control_tag: []
+unbound_access_control_tag_action: []
+unbound_access_control_tag_data: []
+unbound_access_control_view: []
+
+unbound_private_addresses:
+  - '192.168.1.0/24'
+  - '192.168.3.0/24'
+  - '192.168.5.0/24'
+  - '192.168.10.0/24'
+  - '10.1.71.0/24'
+
+unbound_private_domains:
+  - 'mk-labs.cloud'
+
+unbound_domains_insecure: []
+unbound_do_not_query_addresses: []
+unbound_local_zones: []
+unbound_local_datas: []
+unbound_local_data_ptrs: []
+unbound_local_zone_tags: []
+unbound_local_zone_overrides: []
+
+unbound_trust_anchors: []
+unbound_trusted_keys_files: []
+
+### Remote Control ###
+
+unbound_control_enable: "no"
+unbound_control_interface: []
+
+### Stub, forward zones and others ###
+
+unbound_rpz_zones: []  # list of dicts
+unbound_stub_zones: []  # list of dicts
+unbound_forward_zones:
+  - name: 'int.mk-labs.cloud'
+    forward-addr:
+      - '10.1.71.5'
+  - name: '.'
+    forward-addr:
+      - '1.0.0.1@53#one.one.one.one'
+      - '1.1.1.1@53#one.one.one.one'
+
+# For stub and forward zones, if a key inside one of the dict is an iterable,
+# it will iterate inside it to duplicate the option with all the contained
+# values.
+# Can be useful in case of multiple forward-addr for a same zone:
+#   Example:
+#     unbound_forward_zones:
+#       - {name: "test.tld", "forward-addr": ["192.0.2.5", "192.0.2.6"]}
+
+unbound_views: []  # list of strings, as options can be multiples

ansible/host_vars/arcade/vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.111
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/backup/vars

@@ -0,0 +1,6 @@
+---
+# file: host_vars/backup/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+ip_address: "10.1.71.9"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/big-thunder-mountain/old_vars

@@ -0,0 +1,58 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.52
+vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/big-thunder-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.52
+vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/cinderella-castle/vars

@@ -0,0 +1,49 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_clone_source: "fedora-42-xlarge-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "fantasyland"
+proxmox_host_target: "fantasyland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/city-hall/vars

@@ -0,0 +1,48 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "mk-general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/docker01/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/docker01/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+#mac_address: "BC:24:11:03:A9:7B"
+ip_address: 10.1.71.211
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/haunted-mansion/old_vars

@@ -0,0 +1,60 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.61
+vm_mac_address: 'BC:24:11:C9:3A:13'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/haunted-mansion/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.61
+vm_mac_address: 'BC:24:11:C9:3A:13'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/infra01/vars

@@ -5,7 +5,7 @@
 # primary_interface: "enp1s0f0"
 # mac_address: "98:b7:85:1e:c6:f1"
 #ip_address: 10.1.71.51
-hostname: "infra01.{{ base_domain }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 
 # Software
 terraform_version: "1.11.3"

ansible/host_vars/int-master01/vars

@@ -0,0 +1,29 @@
+---
+# file: host_vars/int-master01/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "master"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.61
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp0s31f6"
+boot_mac_address: "54:bf:64:60:52:2d"
+primary_interface: "enp1s0f0"
+install_mac_address: "98:b7:85:20:47:22"
+
+# Static Variables
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-master02/vars

@@ -0,0 +1,29 @@
+---
+# file: host_vars/int-master02/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "master"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.62
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp0s31f6"
+boot_mac_address: "54:bf:64:5f:a2:80"
+primary_interface: "enp1s0f0"
+install_mac_address: "98:b7:85:20:47:3a"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-master03/vars

@@ -0,0 +1,29 @@
+---
+# file: host_vars/int-master03/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "master"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.63
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp0s31f6"
+boot_mac_address: "d8:9e:f3:4c:02:a9"
+primary_interface: "enp1s0f0"
+install_mac_address: "98:b7:85:1f:89:cf"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-worker01/vars

@@ -0,0 +1,29 @@
+---
+# file: host_vars/int-worker02/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "worker"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.164
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp87s0"
+boot_mac_address: "36:47:ca:76:13:49"
+primary_interface: "enp2s0f0"
+install_mac_address: "36:47:ca:76:13:47"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-worker02/vars

@@ -0,0 +1,29 @@
+---
+# file: host_vars/int-worker02/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "worker"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.65
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp87s0"
+boot_mac_address: "58:47:ca:76:13:49"
+primary_interface: "enp2s0f0"
+install_mac_address: "58:47:ca:76:13:47"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/lightning_lane/vars

@@ -0,0 +1,33 @@
+---
+# file: host_vars/lightning_lane/vars
+# Traefik Load Balancer Server
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+proxmox_clone_node: "fantasyland"
+
+# VM Configuration
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+vm_size: "small"
+vm_storage: "general"
+
+# Proxmox HA Configuration
+ha_group: "pve02"
+proxmox_host_target: "pve02"
+
+# Network Configuration
+# IP address for the Traefik load balancer
+ip_address: 10.1.71.24
+#vm_mac_address: 'BC:24:11:50:00:80'
+
+# Software Configuration
+# Traefik will be installed and configured on this host
+
+# VM Template Configuration
+#vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/matchbox/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/matchbox/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+# mac_address: "98:b7:85:1e:c6:f1"
+ip_address: 10.1.71.7
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/monitor/vars

@@ -0,0 +1,17 @@
+---
+# file: host_vars/monitor/vars
+
+# VM Definition
+platform: "proxmox"
+proxmox_clone_node: "pve03"
+vm_clone_source: "fedora-42-large"
+vm_storage: "pve-general"
+ha_group: "pve03"
+
+# Networking
+ip_address: 10.1.71.249
+
+# Software
+#terraform_version: "1.11.3"
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" #change variable to fqdn

ansible/host_vars/n8n/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/matchbox/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "BC:24:11:1B:BB:92"
+ip_address: 10.1.71.81
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/ocp-hub/vars

@@ -0,0 +1,31 @@
+---
+# file: host_vars/ocp-hub/vars
+
+# file: host_vars/int-master01/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "master"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.10
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp0s31f6"
+boot_mac_address: "50:9A:4C:52:A8:5D"
+primary_interface: "enp1s0f0"
+install_mac_address: "98:b7:85:1e:c6:f1"
+
+# Static Variables
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/openshift_node_template/vars

@@ -0,0 +1,29 @@
+---
+# file: host_vars/openshift_node_template/vars
+# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
+
+# Cluster deployed via Agent Installer and Matchbox (iPXE):
+
+# Role of this node in the cluster. 
+# - master
+# - worker
+
+node_role: "master"
+
+# IP address assigned to this node on the Primary Interface
+
+ip_address: 10.1.71.61
+
+# Ansible Playbook supports booting node via one interface, but installing on a 
+# different interface. (Disabling the boot interface on install)  All these fields
+# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
+# should be the same.
+
+boot_interface: "enp0s31f6"
+boot_mac_address: "54:bf:64:60:52:2d"
+primary_interface: "enp1s0f0"
+install_mac_address: "98:b7:85:20:47:22"
+
+# Static Variables
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/peter-pans-flight/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.62
+vm_mac_address: 'BC:24:11:AA:8F:3A'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/peter-pans-flight/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.62
+vm_mac_address: 'BC:24:11:AA:8F:3A'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/pve01/vars

@@ -0,0 +1,7 @@
+---
+# file: host_vars/pve01/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+#ip_address: "10.1.71.51"
+ip_address: "10.10.21.51"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/pve02/vars

@@ -0,0 +1,7 @@
+---
+# file: host_vars/pve02/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+#ip_address: "10.1.71.52"
+ip_address: "10.10.21.52"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/pve03/vars

@@ -0,0 +1,7 @@
+---
+# file: host_vars/pve03/vars
+# mac_address: "98:b7:85:1e:c6:f1"
+#ip_address: "10.1.71.53"
+ip_address: "10.10.21.53"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# primary_interface: "enp1s0f0"

ansible/host_vars/space-mountain/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.51
+vm_mac_address: 'BC:24:11:1A:E8:8C'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/space-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.51
+vm_mac_address: 'BC:24:11:1A:E8:8C'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/splash-mountain/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.53
+vm_mac_address: 'BC:24:11:84:D7:2F'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/splash-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.53
+vm_mac_address: 'BC:24:11:84:D7:2F'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/splash/vars

@@ -0,0 +1,100 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts creation via clone or create.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "small"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "tomorrowland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+# Comment out vm_mac_address if new MAC address should be generated
+
+ip_address: 10.1.71.99
+vm_mac_address: 'BC:24:11:97:C3:AA'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/sql01/vars

@@ -0,0 +1,11 @@
+---
+# file: host_vars/matchbox/vars
+
+# Networking
+# primary_interface: "enp1s0f0"
+mac_address: "BC:24:11:1C:95:1B"
+ip_address: 10.1.71.91
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+
+# Software
+#terraform_version: "1.11.3"

ansible/host_vars/sundial/vars

@@ -0,0 +1,50 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "fantasyland"
+proxmox_host_target: "fantasyland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/tiki-room/vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.23
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/unbound01/vars

@@ -0,0 +1,47 @@
+---
+# file: host_vars/unbound01/vars
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "pve03"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "pve-general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.251
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/unbound02/vars

@@ -0,0 +1,47 @@
+---
+# file: host_vars/unbound02/vars
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "pve03"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "pve-general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.252
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/vm_template/vars

@@ -0,0 +1,104 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts creation via clone or create.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "tomorrowland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+# Comment out vm_mac_address if new MAC address should be generated
+
+ip_address: 10.1.71.249
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+small:
+  cores: 2
+  memory: 2048
+  disk: 8
+
+medium:
+  cores: 2
+  memory: 4096
+  disk: 16
+
+large:
+  cores: 4
+  memory: 4096
+  disk: 32
+
+large-plus:
+  cores: 4
+  memory: 4096
+  disk: 48
+
+xlarge:
+  cores: 4
+  memory: 8192
+  disk: 64
+
+xlarge-plus:
+  cores: 4
+  memory: 8192
+  disk: 128

ansible/inventory.yml

@@ -0,0 +1,132 @@
+# file: inventory.yml
+proxmox:
+  hosts:
+    pve0[1:3]:
+
+ntp_servers:
+  hosts:
+    sundial:
+    
+dns_server:
+  hosts:
+    monorail:
+
+magic_kingdom:
+  hosts:
+    main-street-usa:
+    tomorrowland:
+    fantasyland:
+
+prometheus_server:
+  hosts:
+    cinderella-castle:
+
+prometheus_nodes:
+  hosts:
+    cinderella-castle:
+
+load_balancers:
+  hosts:
+    lightning-lane:
+      ansible_host: 10.1.71.24
+      ansible_become: true
+# node_explorer:
+#   hosts:
+#     cinderella-castle:
+
+# alertmanager:
+#   hosts:
+#     cinderella-castle:
+
+# grafana:
+#   hosts:
+#     cinderella-castle:
+
+papermc_server:
+# ansible-galaxy role install engonzal.papermc
+  hosts:
+    arcade:
+
+semaphore_server:
+  hosts:
+    imagineering:
+
+n8n_server:
+  hosts:
+    tiki-room:
+
+traefik_server:
+  hosts:
+    lightning_lane:
+
+# dhcp_server:
+#   hosts:
+#     matchbox:
+
+backup_servers:
+  hosts:
+    timekeeper:
+
+# freeipa:
+#   hosts:
+#     infra01:
+
+# ipaserver:
+#   hosts:
+#     infra01.int.mk-labs.cloud:
+
+# matchbox_server:
+#   hosts:
+#     matchbox:
+
+terraform_server:
+  hosts:
+    infra01:
+
+# hub_cluster:
+#   hosts:
+#     ocp-hub:
+
+# internal_cluster:
+#   hosts:
+#     int-master01:
+#     int-master02:
+#     int-master03:
+# #    int-worker01:
+#     int-worker02:
+
+# talos_cluster:
+#   hosts:
+#     splash:
+
+# fastpass_control_plane:
+#   hosts:
+#     space-mountain:
+#     big-thunder-mountain:
+#     splash-mountain:
+
+# fastpass_workers:
+#   hosts:
+#     haunted-mansion: # backstage
+#     peter-pans-flight: # backstage
+
+# fastpass:
+#   children:
+#     fastpass_control_plane:
+#     fastpass_workers:
+
+# sql_servers:
+#   hosts:
+#     sql01:
+
+# docker_servers:
+#   hosts:
+#     docker01:
+
+# observer:
+#   hosts:
+#     prometheus:
+
+# target:
+#   hosts:
+#     prometheus:

ansible/mk

@@ -0,0 +1,5 @@
+space-mountain
+splash-mountain
+big-thunder-mountain
+peter-pans-flight
+haunted-mansion

ansible/playbooks/add_dhcp_reservation.yml

@@ -0,0 +1,84 @@
+---
+- name: Bind VM MAC address to IP address on Ubiquiti
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Set VM MAC address (if defined in vars)
+      delegate_to: "localhost"
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        node: "{{ proxmox_clone_node }}"
+        vmid: "{{ vm_id }}"
+        net:
+          net0: "virtio={{ vm_mac_address }},bridge=vmbr0,firewall=1"
+        update: true
+        update_unsafe: true
+      when: vm_mac_address is defined
+
+    - name: Get VM MAC address from Proxmox (not defined in vars)
+      when: vm_mac_address is not defined
+      block:
+        - name: Retrieve information about specific VM by name and get current configuration
+          delegate_to: "localhost"
+          community.proxmox.proxmox_vm_info:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            name: "{{ inventory_hostname }}"
+            config: current
+          register: proxmox_vm_info
+
+        - name: Extract net0 information
+          ansible.builtin.set_fact:
+            vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
+
+        - name: Extract MAC address using regex
+          ansible.builtin.set_fact:
+            vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
+
+    - name: Assign VM MAC address to IP address on Ubiquiti with Terraform
+      when: vm_mac_address is defined
+      delegate_to: "{{ groups['terraform_server'][0] }}"
+      block:
+        - name: Create a directory if it does not exist
+          ansible.builtin.file:
+            path: "~/homelab/terraform/unifi-dhcp"
+            state: directory
+            mode: '0755'
+
+        - name: Create Unifi provider file from template
+          ansible.builtin.template:
+            src: templates/unifi_provider.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/provider.tf
+            mode: '0644'
+
+        - name: Create Unifi user (host) file from template
+          ansible.builtin.template:
+            src: templates/unifi-user.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/{{ inventory_hostname }}.tf
+            mode: '0644'
+
+        - name: Configure Unifi via Terraform
+          community.general.terraform:
+            project_path: ~/homelab/terraform/unifi-dhcp
+            state: present
+            force_init: true
+
+    # - name: Add line to hosts file
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.lineinfile:
+    #     path: /etc/dnsmasq.d/hosts.conf
+    #     regexp: "# {{ inventory_hostname }}$"
+    #     line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
+    #     state: present
+    # # restart dnsmasq service
+    # - name: Restart service dnsmasq
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.service:
+    #     name: dnsmasq
+    #     state: restarted

ansible/playbooks/add_dns_entry.yml

@@ -0,0 +1,13 @@
+---
+# Replacement for add_technitium_dns_entry.yml
+# This playbook uses the modular task file approach
+
+- name: Add DNS entry using Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Include Technitium DNS entry task
+      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+      vars:
+        host_name: "{{ inventory_hostname }}"

ansible/playbooks/add_technitium_dns_entry.yml.backup

@@ -0,0 +1,18 @@
+---
+- name: Add entry to Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: "Create DNS entry for {{ inventory_hostname }}"
+      delegate_to: localhost
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ inventory_hostname }}.{{ base_domain }}"
+        type: "A"
+        ipAddress: "{{ ip_address }}"
+        ptr: true
+        ttl: 360
+#        validate_certs: false

ansible/playbooks/configure_openshift_cluster.yml

@@ -0,0 +1,218 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: internal_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "internal_cluster"
+    download_dir: "/var/cache/openshift-install"
+
+  tasks:
+    - name: Remove previous directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: absent
+
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Check if OpenShift installer file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
+      register: openshift_installer_file
+
+    - name: Download and install OpenShift installer package
+      when: not openshift_installer_file.stat.exists
+      block:
+        - name: Download OpenShift Installer file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive installer file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy install binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift client file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
+      register: openshift_client_file
+
+    - name: Download and install OpenShift client package
+      when: not openshift_client_file.stat.exists
+      block:
+        - name: Download OpenShift Client file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive client file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy client binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

ansible/playbooks/configure_openshift_hub.yml

@@ -0,0 +1,221 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: hub_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: hub_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: hub_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "hub_cluster"
+    download_dir: "/var/cache/openshift-install"
+
+  tasks:
+    - name: Remove previous directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: absent
+
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    # - name: Quit
+    #   ansible.builtin.meta: end_play
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Check if OpenShift installer file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
+      register: openshift_installer_file
+
+    - name: Download and install OpenShift installer package
+      when: not openshift_installer_file.stat.exists
+      block:
+        - name: Download OpenShift Installer file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive installer file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy install binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift client file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
+      register: openshift_client_file
+
+    - name: Download and install OpenShift client package
+      when: not openshift_client_file.stat.exists
+      block:
+        - name: Download OpenShift Client file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive client file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy client binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

ansible/playbooks/configure_openshift_internal.yml

@@ -0,0 +1,218 @@
+---
+- name: Configure DNS entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entry for each cluster node
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        host_ip_address: "{{ ip_address }}"
+
+- name: Configure DNS entries for OpenShift cluster services
+  hosts: internal_cluster[0]
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Create DNS entries for OpenShift cluster services
+      ansible.builtin.include_tasks: tasks/create_dns_record.yml
+      vars:
+        dns_name: "{{ item.name }}"
+        dns_address: "{{ item.address }}"
+      loop:
+        - name: "api.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "api-int.{{ cluster_name }}"
+          address: "{{ api_address }}"
+        - name: "*.apps.{{ cluster_name }}"
+          address: "{{ app_address }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+- name: Configure DHCP entries for cluster nodes
+  hosts: internal_cluster
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Configure DHCP entry for node
+      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
+      vars:
+        host_mac_address: "{{ install_mac_address }}"
+        host_ip_address: "{{ ip_address }}"
+
+  handlers:
+    - name: Restart dnsmasq
+      delegate_to: "{{ dhcp_server }}"
+      become: true
+      ansible.builtin.service:
+        name: dnsmasq
+        state: restarted
+
+- name: Create OpenShift installer files
+  hosts: matchbox
+  gather_facts: true
+
+  vars:
+    cluster_group: "internal_cluster"
+    download_dir: "/var/cache/openshift-install"
+
+  tasks:
+    - name: Remove previous directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: absent
+
+    - name: Create directory
+      ansible.builtin.file:
+        path: ~/homelab/terraform/{{ cluster_group }}
+        state: directory
+        mode: '0755'
+
+    - name: OpenShift Installer install-config.yaml
+      ansible.builtin.template:
+        src: templates/install-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
+        mode: '0644'
+
+    - name: OpenShift Installer agent-config.yaml
+      ansible.builtin.template:
+        src: templates/agent-config.yaml.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
+        mode: '0644'
+
+    - name: Create directory for OpenShift Installer files
+      become: true
+      ansible.builtin.file:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Check if OpenShift installer file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
+      register: openshift_installer_file
+
+    - name: Download and install OpenShift installer package
+      when: not openshift_installer_file.stat.exists
+      block:
+        - name: Download OpenShift Installer file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive installer file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy install binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift client file exists
+      ansible.builtin.stat:
+        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
+      register: openshift_client_file
+
+    - name: Download and install OpenShift client package
+      when: not openshift_client_file.stat.exists
+      block:
+        - name: Download OpenShift Client file
+          become: true
+          ansible.builtin.get_url:
+            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            mode: '0644'
+
+        - name: Unarchive client file
+          become: true
+          ansible.builtin.unarchive:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
+            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
+            remote_src: true
+
+        - name: Copy client binary
+          become: true
+          ansible.builtin.copy:
+            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
+            dest: /usr/local/bin
+            remote_src: true
+            owner: wed
+            group: wed
+            mode: '0755'
+
+    - name: Check if OpenShift image exists
+      ansible.builtin.stat:
+        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
+      register: openshift_image_exists
+
+    - name: OpenShift image creation
+      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
+      args:
+        chdir: ~/homelab/terraform/{{ cluster_group }}
+      when: not openshift_image_exists.stat.exists
+      changed_when: true
+
+    - name: Create a directory if it does not exist
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Copy file with owner and permissions
+      become: true
+      ansible.builtin.copy:
+        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
+        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
+        remote_src: true
+        owner: matchbox
+        group: matchbox
+        mode: '0644'
+
+    - name: Verify directory permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+        state: directory
+        owner: matchbox
+        group: matchbox
+        mode: '0755'
+
+    - name: Create Terraform matchbox groups file from template
+      ansible.builtin.template:
+        src: templates/groups.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox profiles file from template
+      ansible.builtin.template:
+        src: templates/profiles.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
+        mode: '0644'
+
+    - name: Create Terraform matchbox provider file from template
+      ansible.builtin.template:
+        src: templates/provider.tf.j2
+        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
+        mode: '0644'
+
+    - name: Configure Matchbox via Terraform
+      community.general.terraform:
+        project_path: ~/homelab/terraform/{{ cluster_group }}
+        state: present
+        force_init: true

ansible/playbooks/configure_unbound.yml

@@ -0,0 +1,37 @@
+---
+- name: Master playbook to install and configure unbound
+  hosts: unbound_servers
+  become: true
+
+  tasks:
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        service: dns
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Create the directory
+      ansible.builtin.file:
+        path: /etc/systemd/resolved.conf.d
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Put `unbound.conf` in the correct place
+      ansible.builtin.copy:
+        src: ../roles/common/files/unbound.conf
+        dest: /etc/systemd/resolved.conf.d/unbound.conf
+        mode: '0644'
+        owner: root
+        group: root
+
+    - name: Restart service systemd-resolved
+      ansible.builtin.service:
+        name: systemd-resolved
+        state: restarted
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: Anthony25.unbound

ansible/playbooks/create_vm.yml

@@ -0,0 +1,23 @@
+---
+- name: Master playbook to create VM
+  hosts: all
+  gather_facts: false
+
+- name: Proxmox Create VM Playbook
+  ansible.builtin.import_playbook: proxmox_create_vm.yml
+
+- name: Set cloud-init network
+  ansible.builtin.import_playbook: populate_cloud_init.yml
+  when: vm_os_distribution == "ubuntu"
+
+- name: DNS Playbook
+  ansible.builtin.import_playbook: add_dns_entry.yml
+
+- name: DHCP Playbook
+  ansible.builtin.import_playbook: add_dhcp_reservation.yml
+
+- name: Start VM Playbook
+  ansible.builtin.import_playbook: proxmox_start_vm.yml
+
+- name: Set Hostname Playbook
+  ansible.builtin.import_playbook: set_hostname.yml

ansible/playbooks/create_vm_from_clone.yml

@@ -0,0 +1,23 @@
+---
+- name: Master playbook to create VM from a template
+  hosts: all
+  gather_facts: false
+
+- name: Proxmox Clone VM Playbook
+  ansible.builtin.import_playbook: proxmox_clone_vm.yml
+
+- name: Set cloud-init network
+  ansible.builtin.import_playbook: populate_cloud_init.yml
+  when: vm_os_distribution == "ubuntu"
+
+- name: DNS Playbook
+  ansible.builtin.import_playbook: add_dns_entry.yml
+
+- name: DHCP Playbook
+  ansible.builtin.import_playbook: add_dhcp_reservation.yml
+
+- name: Start VM Playbook
+  ansible.builtin.import_playbook: proxmox_start_vm.yml
+
+- name: Set Hostname Playbook
+  ansible.builtin.import_playbook: set_hostname.yml

ansible/playbooks/del_dns_entry.yml

@@ -0,0 +1,16 @@
+---
+- name: Remove entry from DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Delete DNS entry for {{ inventory_hostname }} #on {{ groups['ipa_servers'][0] }}
+      delegate_to: "{{ groups['ipaserver'][0] }}"
+      freeipa.ansible_freeipa.ipadnsrecord:
+        ipaapi_context: "server"
+        ipaadmin_password: "{{ vault_freeipa_password }}"
+        zone_name: "{{ base_domain }}"
+        records:
+          - name: "{{ inventory_hostname }}"
+            del_all: yes
+        state: absent

ansible/playbooks/deploy-fastpass-4step.yml

@@ -0,0 +1,30 @@
+---
+# - name: Step 1 - Install Prerequisites
+#   hosts: fastpass
+#   become: true
+#   gather_facts: true
+#   roles:
+#     - role: kubernetes-prerequisites
+
+# - name: Step 2 - Deploy First Control Plane Node
+#   hosts: fastpass_control_plane[0]
+#   become: true
+#   gather_facts: false
+#   roles:
+#     - role: fastpass-first-control-plane
+
+- name: Step 3 - Deploy Additional Control Plane Nodes
+  hosts: fastpass_control_plane[1:]
+  become: true
+  gather_facts: true # false
+  roles:
+    - role: fastpass-additional-control-plane
+  vars:
+    cluster_name: "fastpass"
+
+# - name: Step 4 - Deploy Worker Nodes
+#   hosts: fastpass_workers
+#   become: true
+#   gather_facts: false
+#   roles:
+#     - role: fastpass-workers

ansible/playbooks/deploy-fastpass-cluster.yml

@@ -0,0 +1,157 @@
+---
+# FastPass Kubernetes Cluster Deployment
+# This playbook deploys a complete Kubernetes cluster on Fedora
+
+- name: 1. Preflight checks and system preparation
+  hosts: fastpass
+  become: true
+  gather_facts: true
+  roles:
+    - role: kubernetes
+
+- name: 2. Initialize first control plane node
+  hosts: fastpass_control_plane[0]
+  become: true
+  gather_facts: false
+  roles:
+    - role: fastpass-control-plane
+
+- name: 3. Install Calico CNI
+  hosts: fastpass_control_plane[0]
+  become: false
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ kubeconfig_path }}"
+  tasks:
+    - name: Check if Calico is already installed
+      ansible.builtin.shell: kubectl get pods -n kube-system -l k8s-app=calico-node --no-headers | wc -l
+      delegate_to: localhost
+      register: calico_check
+      ignore_errors: true
+
+    - name: Display Calico check result
+      ansible.builtin.debug:
+        msg: "Calico pods found: {{ calico_check.stdout | trim }}"
+      delegate_to: localhost
+
+    - name: Install Calico CNI
+      ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/{{ calico_version | default('v3.28.0') }}/manifests/calico.yaml
+      delegate_to: localhost
+      when: calico_check.stdout | trim == "0"
+      register: calico_install_result
+      ignore_errors: true
+
+    - name: Display Calico installation result
+      ansible.builtin.debug:
+        msg: "Calico install stdout: {{ calico_install_result.stdout }}"
+      delegate_to: localhost
+      when: calico_check.stdout | trim == "0"
+
+    - name: Wait for Calico node pods to be ready
+      ansible.builtin.command: kubectl wait --for=condition=ready pod -l k8s-app=calico-node -n kube-system --timeout=300s
+      delegate_to: localhost
+      when: calico_check.stdout | trim == "0"
+
+- name: 4. Wait for first control plane to be fully ready
+  hosts: fastpass_control_plane[0]
+  become: false
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ kubeconfig_path }}"
+  tasks:
+    - name: Wait for API server to be ready on first node
+      ansible.builtin.wait_for:
+        host: "{{ inventory_hostname }}"
+        port: "{{ control_plane_port | default('6443') }}"
+        timeout: 300
+      delegate_to: localhost
+
+    - name: Wait for first control plane node to be ready
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node {{ inventory_hostname }} --timeout=300s
+      delegate_to: localhost
+
+    - name: Verify control plane status
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
+      delegate_to: localhost
+      register: node_status
+
+    - name: Display cluster status
+      ansible.builtin.debug:
+        msg: "{{ node_status.stdout_lines }}"
+
+- name: 5. Join additional control plane nodes
+  hosts: fastpass_control_plane[1:]
+  become: true
+  gather_facts: false
+  roles:
+    - role: fastpass-control-plane-join
+
+- name: 6. Wait for all control plane nodes to be ready
+  hosts: fastpass_control_plane[0]
+  become: false
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ kubeconfig_path }}"
+  tasks:
+    - name: Wait for all control plane nodes to be ready
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --selector=node-role.kubernetes.io/control-plane --timeout=600s
+      delegate_to: localhost
+
+    - name: Display all control plane nodes
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes --selector=node-role.kubernetes.io/control-plane -o wide
+      delegate_to: localhost
+      register: control_plane_status
+
+    - name: Show control plane status
+      ansible.builtin.debug:
+        msg: "{{ control_plane_status.stdout_lines }}"
+
+- name: 7. Join worker nodes
+  hosts: fastpass_workers
+  become: true
+  gather_facts: false
+  roles:
+    - role: fastpass-workers
+
+- name: 8. Final cluster validation
+  hosts: fastpass_control_plane[0]
+  become: false
+  gather_facts: false
+  environment:
+    KUBECONFIG: "{{ kubeconfig_path }}"
+  tasks:
+    - name: Wait for all nodes to be ready
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --all --timeout=300s
+      delegate_to: localhost
+
+    - name: Verify all pods are running
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get pods --all-namespaces
+      delegate_to: localhost
+      register: pod_status
+
+    - name: Display final cluster status
+      ansible.builtin.debug:
+        msg: |
+          ========================================
+          FastPass Kubernetes Cluster Status
+          ========================================
+          {{ pod_status.stdout }}
+          ========================================
+
+    - name: Show final node status
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
+      delegate_to: localhost
+      register: final_node_status
+
+    - name: Display final node status
+      ansible.builtin.debug:
+        msg: "{{ final_node_status.stdout_lines }}"
+
+    - name: Test DNS-based control plane endpoint
+      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} cluster-info
+      delegate_to: localhost
+      register: cluster_info
+
+    - name: Display cluster info
+      ansible.builtin.debug:
+        msg: "{{ cluster_info.stdout_lines }}" 

ansible/playbooks/deploy-haproxy-cloudflare.yml

@@ -0,0 +1,177 @@
+---
+# ansible/playbooks/deploy-haproxy-cloudflare.yml
+
+- name: Deploy HAProxy with Cloudflare DNS certificates
+  hosts: lightning-lane
+  become: true
+
+  vars:
+    # Certbot Cloudflare configuration
+    haproxy_certbot_enable: true
+    haproxy_certbot_challenge_method: "dns-cloudflare"
+    haproxy_certbot_email: "ryan@mk-labs.cloud"
+    haproxy_certbot_staging: false  # Set to true for testing
+    haproxy_certbot_cloudflare_api_token: "{{ vault_cloudflare_api_token }}"
+
+    # Request wildcard certificate
+    haproxy_certbot_domains:
+      - domain: "*.local.mk-labs.cloud"
+        include_base: true  # Also include local.mk-labs.cloud
+
+    # HAProxy Stats
+    haproxy_stats_password: "{{ vault_haproxy_stats_password }}"
+
+    # Frontend configuration
+    haproxy_frontends:
+      - name: https_front
+        bind: "*:443 ssl crt {{ haproxy_ssl_cert_dir }}/live crt {{ haproxy_ssl_default_crt }} alpn h2,http/1.1"
+        mode: http
+        options:
+          - "http-server-close"
+          - "forwardfor"
+        acls:
+          - "netbox hdr(host) -i fire-station.local.mk-labs.cloud"
+          - "wordpress hdr(host) -i be-our-guest.local.mk-labs.cloud"
+          - "plane hdr(host) -i people-mover.local.mk-labs.cloud"
+          - "minecraft hdr(host) -i arcade.local.mk-labs.cloud"
+        use_backends:
+          - "netbox_back if netbox"
+          - "wordpress_back if wordpress"
+          - "plane_back if plane"
+          - "minecraft_back if minecraft"
+
+    # Backend configuration
+    haproxy_backends:
+      - name: netbox_back
+        mode: http
+        balance: roundrobin
+        options:
+          - "httpchk GET /api/"
+        servers:
+          - name: fire-station
+            address: 10.1.71.102:8000
+            check: true
+
+      - name: wordpress_back
+        mode: http
+        balance: roundrobin
+        servers:
+          - name: be-our-guest
+            address: 10.1.71.101:80
+            check: true
+
+      - name: plane_back
+        mode: http
+        balance: roundrobin
+        servers:
+          - name: people-mover
+            address: 10.1.71.112:8080
+            check: true
+
+      - name: minecraft_back
+        mode: http
+        balance: roundrobin
+        servers:
+          - name: arcade
+            address: 10.1.71.111:25565
+            check: true
+
+    # TCP services
+    haproxy_tcp_services:
+      - name: postgres
+        frontend_port: 5432
+        backend_port: 5432
+        balance: leastconn
+        timeout_client: 1h
+        timeout_server: 1h
+        servers:
+          - name: netbox-db
+            address: 10.1.71.102
+            check: true
+
+      - name: ssh_jump
+        frontend_port: 2222
+        backend_port: 22
+        balance: source
+        servers:
+          - name: main-street-usa
+            address: 10.1.71.11
+            check: true
+          - name: tomorrowland
+            address: 10.1.71.12
+            check: true
+          - name: fantasyland
+            address: 10.1.71.13
+            check: true
+
+      - name: minecraft_java
+        frontend_port: 25565
+        backend_port: 25565
+        balance: roundrobin
+        servers:
+          - name: arcade
+            address: 10.1.71.111
+            check: true
+
+    # Firewall configuration
+    haproxy_firewall_allowed_ports:
+      - 80/tcp
+      - 443/tcp
+      - 2222/tcp
+      - 5432/tcp
+      - 8404/tcp
+      - 25565/tcp
+
+  pre_tasks:
+    - name: Ensure required groups exist
+      ansible.builtin.group:
+        name: "{{ item }}"
+        state: present
+      loop:
+        - haproxy
+
+  roles:
+    - haproxy
+
+  post_tasks:
+    - name: Wait for HAProxy to be ready
+      ansible.builtin.wait_for:
+        host: "{{ ansible_default_ipv4.address }}"
+        port: 443
+        timeout: 60
+
+    - name: Display deployment summary
+      ansible.builtin.debug:
+        msg: |
+          ╔════════════════════════════════════════════════════════════╗
+          ║  HAProxy Deployment Complete - lightning-lane              ║
+          ╚════════════════════════════════════════════════════════════╝
+
+          Stats Interface: http://{{ ansible_default_ipv4.address }}:8404/stats
+          Username: {{ haproxy_stats_username }}
+
+          HTTPS Services:
+          {% for frontend in haproxy_frontends %}
+          {% if frontend.acls is defined %}
+          {% for acl in frontend.acls %}
+          - {{ acl.split()[1] | regex_replace('hdr\\(host\\)', '') | regex_replace('-i', '') | trim }}
+          {% endfor %}
+          {% endif %}
+          {% endfor %}
+
+          TCP Services:
+          {% for tcp in haproxy_tcp_services %}
+          - {{ tcp.name }}: {{ ansible_default_ipv4.address }}:{{ tcp.frontend_port }}
+          {% endfor %}
+
+          Certificates:
+          {% for domain in haproxy_certbot_domains %}
+          - {{ domain.domain }}{% if domain.include_base | default(false) %} + base domain{% endif %}
+
+          {% endfor %}
+
+          Next steps:
+          1. Verify certificate: certbot certificates
+          2. Test renewal: certbot renew --dry-run
+          3. Check HAProxy stats interface
+          4. Test HTTPS endpoints

ansible/playbooks/deploy_k8s.yml

@@ -0,0 +1,17 @@
+# ------------------------------------------------------------------------------
+# FILE: deploy_k8s.yml
+# ------------------------------------------------------------------------------
+- name: 1. Prepare all nodes for Kubernetes
+  hosts: fastpass
+  roles:
+    - role: kubernetes
+
+- name: 2. Initialize and configure the control plane
+  hosts: fastpass_control_plane
+  roles:
+    - role: fastpass-control-plane
+
+- name: 3. Join worker nodes to the cluster
+  hosts: fastpass_workers
+  roles:
+    - role: fastpass-workers

ansible/playbooks/deploy_minecraft.yml

@@ -0,0 +1,22 @@
+---
+# - name: Install additional packages
+#   hosts: papermc_server
+#   become: true
+#   tasks:
+#     - name: Install python-apt packages
+#       ansible.builtin.package:
+#         name: "libapt-pkg"
+#         state: latest
+#         update_cache: true
+
+- name: 1. Deploy Paper Minecraft server
+  hosts: papermc_server
+  roles:
+
+  vars:
+    user:
+      home_dir: /opt/minecraft
+      name: wed
+  roles:
+    - role: apigban.papermc_role
+      become: yes

ansible/playbooks/deploy_n8n_server.yml

@@ -0,0 +1,5 @@
+- name: 1. Deploy n8n server
+  hosts: n8n_server
+  gather_facts: true
+  roles:
+    - role: n8n

ansible/playbooks/deploy_ntp_servers.yml

@@ -0,0 +1,5 @@
+- name: 1. Deploy NTP servers
+  hosts: ntp_servers
+  gather_facts: true
+  roles:
+    - role: ntp-server

ansible/playbooks/examples/multi-cluster-kubeconfig.yml

@@ -0,0 +1,41 @@
+---
+# Example playbook showing how to use the modular kubeconfig management
+# across multiple clusters in your homelab
+
+- name: Setup kubeconfig for FastPass cluster
+  hosts: fastpass_control_plane[0]
+  gather_facts: true
+  roles:
+    - role: kubeconfig-manager
+      vars:
+        cluster_name: "fastpass"
+
+- name: Setup kubeconfig for Hub cluster
+  hosts: hub_cluster
+  gather_facts: true
+  roles:
+    - role: kubeconfig-manager
+      vars:
+        cluster_name: "hub"
+
+- name: Setup kubeconfig for Internal cluster
+  hosts: internal_cluster[0]
+  gather_facts: true
+  roles:
+    - role: kubeconfig-manager
+      vars:
+        cluster_name: "internal"
+
+# Alternative approach using the generic cluster-kubeconfig role
+- name: Setup kubeconfig for any cluster
+  hosts: "{{ target_cluster_hosts }}"
+  gather_facts: true
+  roles:
+    - role: cluster-kubeconfig
+      vars:
+        cluster_name: "{{ target_cluster_name }}"
+
+# Usage examples:
+# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml
+# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml --limit fastpass_control_plane[0]
+# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml -e target_cluster_hosts=hub_cluster -e target_cluster_name=hub

ansible/playbooks/examples/setup-fastpass-network.yml

@@ -0,0 +1,60 @@
+---
+# Example: Setup network infrastructure for FastPass cluster
+# This demonstrates the modular approach for DNS and load balancer setup
+
+- name: Setup FastPass Cluster Network Infrastructure
+  hosts: fastpass_control_plane[0]
+  gather_facts: true
+  vars:
+    cluster_name: "fastpass"
+    cluster_endpoint: "{{ control_plane_endpoint }}"
+    cluster_vip: "{{ ansible_default_ipv4.address }}"
+    control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
+  
+  tasks:
+    - name: Display cluster configuration
+      ansible.builtin.debug:
+        msg: |
+          Setting up network for FastPass cluster:
+          - Cluster Name: {{ cluster_name }}
+          - Endpoint: {{ cluster_endpoint }}
+          - VIP: {{ cluster_vip }}
+          - Control Plane Nodes: {{ control_plane_nodes | join(', ') }}
+
+    - name: Setup cluster network infrastructure
+      ansible.builtin.include_role:
+        name: cluster-network-setup
+      vars:
+        cluster_name: "{{ cluster_name }}"
+        cluster_endpoint: "{{ cluster_endpoint }}"
+        cluster_vip: "{{ cluster_vip }}"
+        control_plane_nodes: "{{ control_plane_nodes }}"
+
+# Alternative approach using task file directly
+- name: Alternative - Use Technitium DNS task directly
+  hosts: localhost
+  gather_facts: false
+  vars:
+    cluster_endpoint: "{{ hostvars[groups['fastpass_control_plane'][0]]['control_plane_endpoint'] }}"
+    cluster_vip: "{{ hostvars[groups['fastpass_control_plane'][0]]['ansible_default_ipv4']['address'] }}"
+  
+  tasks:
+    - name: Create DNS entry using task file
+      ansible.builtin.include_tasks: ../tasks/add_technitium_dns_entry.yml
+      vars:
+        dns_record_name: "{{ cluster_endpoint.split('.')[0] }}"
+        dns_zone: "{{ base_domain }}"
+        dns_ip_address: "{{ cluster_vip }}"
+        dns_record_type: "A"
+        dns_ttl: 360
+        dns_create_ptr: true
+        dns_debug: true
+      when: use_task_approach | default(false)
+
+# Usage examples:
+# 
+# Use modular approach (recommended):
+# ansible-playbook -i inventory.yml playbooks/examples/setup-fastpass-network.yml
+#
+# Use task file approach:
+# ansible-playbook -i inventory.yml playbooks/examples/setup-fastpass-network.yml -e use_task_approach=true

ansible/playbooks/idm-servers.yml

@@ -3,8 +3,8 @@
   hosts: ipaserver
   become: true
   vars_files:
-  - idm-vault.yml
+    - idm-vault.yml
 
   roles:
-  - role: freeipa.ansible_freeipa.ipaserver
-    state: present
+    - role: freeipa.ansible_freeipa.ipaserver
+      state: present

ansible/playbooks/install_monitoring.yml

@@ -0,0 +1,67 @@
+---
+- name: Master playbook to install and configure prometheus
+  hosts: prometheus_server
+  become: true
+
+  tasks:
+    - name: Install prerequisite software
+      ansible.builtin.dnf:
+        name:
+          - tar
+          - python3-dnf
+        state: present
+
+    - name: Permit prometheus metrics in default zone for dns service
+      ansible.posix.firewalld:
+        port: 9100/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        port: 9090/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install prometheus via role
+      ansible.builtin.import_role:
+        name: prometheus.prometheus.prometheus
+      vars:
+        prometheus_targets:
+          node:
+          - targets:
+            - localhost:9100
+            labels:
+              env: mk-labs
+
+    - name: Permit grafana in default zone for dns service
+      ansible.posix.firewalld:
+        port: 3000/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install grafana via role
+      ansible.builtin.import_role:
+        name: grafana.grafana.grafana
+
+    # - name: Create/Update Data sources
+    #   grafana.grafana.datasource:
+    #     dataSource: |
+    #       {
+    #         "name": "Prometheus",
+    #         "type": "prometheus",
+    #         "access": "proxy",
+    #         "url": "http://localhost:9090",
+    #         "jsonData": {
+    #           "httpMethod": "POST",
+    #           "manageAlerts": true,
+    #           "prometheusType": "Prometheus",
+    #           "cacheLevel": "High"
+    #         }
+    #       }
+    #     grafana_url: "{{ grafana_url }}"
+    #     grafana_api_key: "{{ grafana_api_key }}"
+    #     state: present

ansible/playbooks/monitoring.yml

@@ -0,0 +1,15 @@
+- name: Install Observability stack (targets)
+  hosts: target
+  tags:
+      - monitoring
+      - target
+  roles:
+      - ../roles/target
+
+- name: Install Observability stack (observer)
+  hosts: observer
+  tags:
+      - monitoring
+      - observer
+  roles:
+      - ../roles/observer

ansible/playbooks/node_explorer.yml

@@ -0,0 +1,16 @@
+---
+- name: Master playbook to install and configure prometheus node explorer
+  hosts: prometheus_server
+  become: true
+
+  tasks:
+    - name: Permit prometheus metrics in default zone for dns service
+      ansible.posix.firewalld:
+        port: 9100/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install prometheus node exporter via role
+      ansible.builtin.import_role:
+        name: prometheus.prometheus.node_exporter

ansible/playbooks/populate_cloud_init.yml

@@ -0,0 +1,31 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Modify Proxmox Ubuntu VM
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      block:
+        - name: Update cloud-init file
+          community.proxmox.proxmox_kvm:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            node: "{{ proxmox_clone_node }}"
+            vmid: "{{ vm_id }}"
+            ipconfig:
+              ipconfig0: "ip=dhcp"
+            update: true
+
+        # - name: Add VM to HA group
+        #   community.proxmox.proxmox_cluster_ha_resources:
+        #     api_user: "{{ proxmox_user }}"
+        #     api_password: "{{ proxmox_password }}"
+        #     api_host: "{{ proxmox_host }}"
+        #     name: vm:"{{ vm_id }}"
+        #     state: "present"
+        #     group: "{{ ha_group }}"
+        #     max_relocate: 2
+        #     max_restart: 2

ansible/playbooks/prometheus_grafana_server.yml

@@ -0,0 +1,143 @@
+---
+- name: Install Prometheus and Grafana on control node
+  hosts: prometheus_server
+  become: true
+  # vars_files:
+  #   - vars.yml
+  tasks:
+    - name: Install prerequisite software
+      ansible.builtin.dnf:
+        name: 
+          - tar
+          - wget
+        state: present
+
+    - name: Download Prometheus
+      ansible.builtin.get_url:
+        url: "{{ prometheus_installer_download_url }}"
+        dest: "/tmp/{{ prometheus_installer_file }}"
+
+    - name: Extract Prometheus
+      ansible.builtin.unarchive:
+        src: "/tmp/{{ prometheus_installer_file }}"
+        dest: "/usr/local/bin/"
+        remote_src: true
+
+    - name: Create Prometheus user
+      user:
+        name: prometheus
+        shell: /bin/false
+        state: present
+
+    - name: Create Prometheus directories
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        owner: prometheus
+        group: prometheus
+      with_items:
+        - /etc/prometheus
+        - /var/lib/prometheus
+
+    - name: Move Prometheus binaries
+      ansible.builtin.command: "mv /usr/local/bin/prometheus-{{ prometheus_version }}.linux-amd64/prometheus /usr/local/bin/prometheus"
+
+    - name: Move Prometheus tool
+      ansible.builtin.command: "mv /usr/local/bin/prometheus-{{ prometheus_version }}.linux-amd64/promtool /usr/local/bin/promtool"
+
+    - name: Create Prometheus configuration file
+      ansible.builtin.copy:
+        dest: "/etc/prometheus/prometheus.yml"
+        content: |
+          global:
+            scrape_interval: 15s
+            evaluation_interval: 15s
+
+          scrape_configs:
+            - job_name: 'prometheus'
+              static_configs:
+                - targets: ['localhost:9090']
+
+            - job_name: 'nodes'
+              static_configs:
+                - targets:
+                  {% for ip in prometheus_nodes %}
+                  - '{{ ip }}:9100'
+                  {% endfor %}
+
+    - name: Create Prometheus service file
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/prometheus.service"
+        content: |
+          [Unit]
+          Description=Prometheus
+          Wants=network-online.target
+          After=network-online.target
+
+          [Service]
+          User=prometheus
+          Group=prometheus
+          Type=simple
+          ExecStart=/usr/local/bin/prometheus \
+            --config.file=/etc/prometheus/prometheus.yml \
+            --storage.tsdb.path=/var/lib/prometheus/ \
+            --web.console.templates=/etc/prometheus/consoles \
+            --web.console.libraries=/etc/prometheus/console_libraries
+
+          [Install]
+          WantedBy=multi-user.target
+
+      register: prometheus_service_status
+      ignore_errors: true
+
+    - name: Check if Prometheus service is running
+      ansible.builtin.command: systemctl is-active prometheus
+      register: prometheus_status
+      changed_when: false
+      ignore_errors: true
+
+    - name: Permit prometheus endpoint in default zone for dns service
+      firewalld:
+        port: 9090/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Permit prometheus metrics in default zone for dns service
+      firewalld:
+        port: 9100/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Permit grafana traffic in default zone for dns service
+      firewalld:
+        port: 3000/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Manage Prometheus service state
+      systemd:
+        name: prometheus
+        state: "{{ 'restarted' if prometheus_status.rc == 0 else 'started' }}"
+        enabled: true
+
+    - name: Add repository
+      ansible.builtin.yum_repository:
+        name: grafana
+        description: Grafana OSS repo
+        baseurl: https://rpm.grafana.com
+        gpgkey: https://rpm.grafana.com/gpg.key
+
+    - name: Install Grafana
+      ansible.builtin.dnf:
+        name: 
+          - grafana
+        state: present
+
+    - name: Start Grafana service
+      systemd:
+        name: grafana-server
+        state: started
+        enabled: true

ansible/playbooks/proxmox_clone_vm.yml

@@ -0,0 +1,37 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Create Proxmox VMs
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      block:
+        - name: Create VM ID from IP address
+          ansible.builtin.set_fact:
+            vm_id: "{{ ip_address.split('.')[-2] }}{{ '%03d' % (ip_address.split('.')[-1] | int) }}"
+
+        - name: Clone VM with source vmid and target newid and raw format
+          community.proxmox.proxmox_kvm:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            clone: "{{ vm_clone_source }}"
+            newid: "{{ vm_id }}"
+            name: "{{ inventory_hostname }}"
+            node: "{{ proxmox_clone_node }}"
+            storage: "{{ vm_storage }}"
+            format: qcow2 # raw
+            timeout: 600
+
+        # - name: Add VM to HA group
+        #   community.proxmox.proxmox_cluster_ha_resources:
+        #     api_user: "{{ proxmox_user }}"
+        #     api_password: "{{ proxmox_password }}"
+        #     api_host: "{{ proxmox_host }}"
+        #     name: vm:"{{ vm_id }}"
+        #     state: "present"
+        #     group: "{{ ha_group }}"
+        #     max_relocate: 2
+        #     max_restart: 2

ansible/playbooks/proxmox_create_vm.yml

@@ -0,0 +1,50 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Create Proxmox VMs
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      block:
+        - name: Create VM ID from IP address
+          ansible.builtin.set_fact:
+            vm_id: "{{ ip_address.split('.')[-2] }}{{ '%03d' % (ip_address.split('.')[-1] | int) }}"
+
+        - name: Create VM with an EFI disk, with Secure Boot disabled by default
+          community.proxmox.proxmox_kvm:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            name: "{{ inventory_hostname }}"
+            node: "{{ proxmox_clone_node }}"
+            vmid: "{{ vm_id }}"
+            net:
+              net0: "virtio,bridge=vmbr0"
+            ide:
+              ide0: "{{ vm_iso_storage }}:iso/{{ vm_iso }},media=cdrom"
+            scsihw: "virtio-scsi-single"
+            scsi:
+              scsi0: "{{ vm_storage }}:{{ vm_definitions[vm_size]['disk'] }},format=qcow2"
+            bios: "ovmf"
+            cpu: "x86-64-v2"
+            cores: "{{ vm_definitions[vm_size]['cores'] }}"
+            memory: "{{ vm_definitions[vm_size]['memory'] }}"
+            efidisk0:
+              storage: "{{ vm_storage }}"
+              format: raw
+              efitype: 4m
+              pre_enrolled_keys: false
+            timeout: 600
+
+        # - name: Add VM to HA group
+        #   community.proxmox.proxmox_cluster_ha_resources:
+        #     api_user: "{{ proxmox_user }}"
+        #     api_password: "{{ proxmox_password }}"
+        #     api_host: "{{ proxmox_host }}"
+        #     name: vm:"{{ vm_id }}"
+        #     state: "present"
+        #     group: "{{ ha_group }}"
+        #     max_relocate: 2
+        #     max_restart: 2