homelab/ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml

---
- name: Set Kubernetes-compatible hostname
  ansible.builtin.hostname:
    name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"

- name: Remove zram-generator-defaults
  ansible.builtin.file:
    path: /etc/systemd/zram-generator.conf
    state: absent

- name: Disable swap
  ansible.builtin.shell: swapoff -a
  when: disable_swap | default(true)

- name: Persist swap off by commenting out swap in fstab
  ansible.builtin.replace:
    path: /etc/fstab
    regexp: '^([^#].*?\sswap\s+sw\s+.*)$'
    replace: '# \1'
  when: disable_swap | default(true)

- name: Load required kernel modules
  ansible.builtin.modprobe:
    name: "{{ item }}"
  loop: "{{ required_kernel_modules }}"

- name: Persist kernel modules on boot
  ansible.builtin.copy:
    dest: /etc/modules-load.d/k8s.conf
    content: "{{ required_kernel_modules | join('\n') }}"
    owner: root
    group: root
    mode: '0644'

- name: Configure required sysctl params for Kubernetes
  ansible.builtin.template:
    dest: /etc/sysctl.d/k8s.conf
    src: k8s-sysctl.conf.j2
    owner: root
    group: root
    mode: '0644'

- name: Apply sysctl params without reboot
  ansible.builtin.shell: sysctl --system

- name: Install python3-libselinux for managing selinux
  ansible.builtin.dnf:
    name: python3-libselinux
    state: present

- name: Set SELinux to permissive mode
  ansible.posix.selinux:
    policy: targeted
    state: "{{ selinux_state }}"

- name: Install and configure chrony for time synchronization
  ansible.builtin.dnf:
    name: chrony
    state: present
  when: configure_ntp | default(true)

- name: Start and enable chronyd
  ansible.builtin.systemd:
    name: chronyd
    state: started
    enabled: true
  when: configure_ntp | default(true)

- name: Force time synchronization
  ansible.builtin.shell: chronyc makestep
  ignore_errors: true
  when: configure_ntp | default(true)

- name: Install firewalld
  ansible.builtin.dnf:
    name: firewalld
    state: present
  when: configure_firewall | default(true)

- name: Start and enable firewalld
  ansible.builtin.systemd:
    name: firewalld
    state: started
    enabled: true
  when: configure_firewall | default(true)

- name: Create Kubernetes service definition
  ansible.builtin.template:
    dest: /etc/firewalld/services/kubernetes.xml
    owner: root
    group: root
    mode: '0644'
    src: kubernetes-firewall-service.xml.j2
  when: configure_firewall | default(true)

- name: Reload firewalld to load new service
  ansible.builtin.shell: firewall-cmd --reload
  when: configure_firewall | default(true)

- name: Add Kubernetes service to default zone
  ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
  when: configure_firewall | default(true)

- name: Add SSH service to default zone (ensure SSH access)
  ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
  when: configure_firewall | default(true)

- name: Reload firewalld to apply changes
  ansible.builtin.shell: firewall-cmd --reload
  when: configure_firewall | default(true)

- name: Verify Kubernetes service is active
  ansible.builtin.shell: firewall-cmd --list-services
  register: active_services
  when: configure_firewall | default(true)

- name: Display active firewall services
  ansible.builtin.debug:
    msg: "Active firewall services: {{ active_services.stdout }}"
  when: configure_firewall | default(true)

- name: Install DNF plugins core for managing repositories
  ansible.builtin.dnf:
    name: dnf-plugins-core
    state: present

- name: Add Docker CE repository
  ansible.builtin.shell: |
    curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo

- name: Install containerd
  ansible.builtin.dnf:
    name: containerd
    state: present

- name: Create containerd config directory
  ansible.builtin.file:
    path: /etc/containerd
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Generate default containerd config and enable SystemdCgroup
  ansible.builtin.shell: |
    containerd config default > /etc/containerd/config.toml
    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml

- name: Restart and enable containerd service
  ansible.builtin.systemd:
    name: containerd
    state: restarted
    enabled: true

- name: Add Kubernetes repository
  ansible.builtin.template:
    dest: /etc/yum.repos.d/kubernetes.repo
    owner: root
    group: root
    mode: '0644'
    src: kubernetes.repo.j2

- name: Install Kubernetes packages
  ansible.builtin.dnf:
    name:
      - kubelet
      - kubeadm
      - kubectl
      - kubernetes-cni
    state: present

- name: Create kubelet config directory
  ansible.builtin.file:
    path: /var/lib/kubelet
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: Create initial kubelet config file
  ansible.builtin.copy:
    dest: /var/lib/kubelet/config.yaml
    owner: root
    group: root
    mode: '0644'
    content: |
      apiVersion: kubelet.config.k8s.io/v1beta1
      kind: KubeletConfiguration
      cgroupDriver: systemd
      containerRuntimeEndpoint: unix:///run/containerd/containerd.sock

- name: Install CNI plugins via dnf
  ansible.builtin.dnf:
    name: containernetworking-plugins
    state: present

- name: Verify CNI plugins installation
  ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
  register: cni_plugins
  ignore_errors: true

- name: Display installed CNI plugins
  ansible.builtin.debug:
    msg: "CNI plugins status: {{ cni_plugins.stdout }}"

- name: Enable kubelet service (but don't start yet)
  ansible.builtin.systemd:
    name: kubelet
    enabled: true
    state: stopped