---
# System preparation for Kubernetes

- name: Disable swap
  ansible.builtin.command: swapoff -a
  become: true
  changed_when: false
  when: disable_swap | default(true)

- name: Persist swap off by commenting out swap in fstab
  become: true
  ansible.builtin.replace:
    path: /etc/fstab
    regexp: '^(\s*)([^#\n]+\s+swap\s+.*)$'
    replace: '#\2'
    backup: true
  when: disable_swap | default(true)

- name: Load required kernel modules
  become: true
  community.general.modprobe:
    name: "{{ item }}"
    state: present
  loop:
    - overlay
    - br_netfilter

- name: Persist kernel modules on boot
  become: true
  ansible.builtin.copy:
    dest: /etc/modules-load.d/k8s.conf
    content: |
      overlay
      br_netfilter
    mode: '0644'

- name: Configure required sysctl params for Kubernetes
  become: true
  ansible.builtin.copy:
    dest: /etc/sysctl.d/k8s.conf
    content: |
      net.bridge.bridge-nf-call-iptables  = 1
      net.bridge.bridge-nf-call-ip6tables = 1
      net.ipv4.ip_forward                 = 1
    mode: '0644'

- name: Apply sysctl params without reboot
  become: true
  ansible.builtin.command: sysctl --system
  changed_when: false

- name: Install required packages
  become: true
  ansible.builtin.dnf:
    name:
      - python3-libselinux
      - dnf-plugins-core
      - curl
      - wget
      - ca-certificates
    state: present

- name: Set SELinux to permissive mode
  become: true
  ansible.posix.selinux:
    policy: targeted
    state: "{{ selinux_mode | default('permissive') }}"

- name: Stop and disable firewalld
  become: true
  ansible.builtin.systemd:
    name: firewalld
    state: stopped
    enabled: false
  when: not firewall_enabled | default(false)

- name: Update system packages
  become: true
  ansible.builtin.dnf:
    name: "*"
    state: latest
  async: 300
  poll: 10