homelab/ansible/playbooks/roles/kubernetes-prerequisites/tasks/main.yml

---
# Role to set/install Kubernetes prerequisites

- name: 1. Set Kubernetes-compatible hostname
  ansible.builtin.hostname:
    name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"

- name: 2. Disable swap
  ansible.builtin.include_role:
    name: no-swap

- name: 3.1 Load required kernel modules
  become: true
  ansible.builtin.modprobe:
    name: "{{ item }}"
  loop: "{{ required_kernel_modules }}"

- name: 3.2 Persist kernel modules on boot
  become: true
  ansible.builtin.copy:
    dest: /etc/modules-load.d/k8s.conf
    content: "{{ required_kernel_modules | join('\n') }}"
    owner: root
    group: root
    mode: '0644'

- name: 3.3 Configure required sysctl params for Kubernetes
  become: true
  ansible.builtin.copy:
    dest: /etc/sysctl.d/kubernetes.conf
    content: "{{ k8s_sysctl_params | join('\n') }}"
    owner: root
    group: root
    mode: '0644'

- name: 3.4 Apply sysctl params without reboot
  become: true
  ansible.builtin.shell: sysctl --system

- name: 3.5 Manage SELinux
  become: true
  when: ansible_os_family == "RedHat"
  block:
    - name: 3.5.1 Install python3-libselinux for managing selinux
      ansible.builtin.dnf:
        name: python3-libselinux
        state: present

    - name: 3.5.2 Set SELinux to permissive mode
      ansible.posix.selinux:
        policy: targeted
        state: "{{ selinux_state }}"

- name: 4 Manage Time Synchronization
  become: true
  block:
    - name: Check if ntp is installed
      ansible.builtin.package: rpm -q ntp
      register: ntp_installed
      changed_when: false

    - name: 4.1 Remove the ntp package
      ansible.builtin.package:
        name: ntp
        state: absent

    - name: 4.2 Install the chrony package
      ansible.builtin.package:
        name: chrony
        state: present


# - name: Start and enable chronyd
#   ansible.builtin.systemd:
#     name: chronyd
#     state: started
#     enabled: true
#   when: configure_ntp | default(true)

# - name: Force time synchronization
#   ansible.builtin.shell: chronyc makestep
#   ignore_errors: true
#   when: configure_ntp | default(true)

# - name: Install firewalld
#   ansible.builtin.dnf:
#     name: firewalld
#     state: present
#   when: configure_firewall | default(true)

# - name: Start and enable firewalld
#   ansible.builtin.systemd:
#     name: firewalld
#     state: started
#     enabled: true
#   when: configure_firewall | default(true)

# - name: Create Kubernetes service definition
#   ansible.builtin.template:
#     dest: /etc/firewalld/services/kubernetes.xml
#     owner: root
#     group: root
#     mode: '0644'
#     src: kubernetes-firewall-service.xml.j2
#   when: configure_firewall | default(true)

# - name: Reload firewalld to load new service
#   ansible.builtin.shell: firewall-cmd --reload
#   when: configure_firewall | default(true)

# - name: Add Kubernetes service to default zone
#   ansible.builtin.shell: firewall-cmd --permanent --add-service=kubernetes
#   when: configure_firewall | default(true)

# - name: Add SSH service to default zone (ensure SSH access)
#   ansible.builtin.shell: firewall-cmd --permanent --add-service=ssh
#   when: configure_firewall | default(true)

# - name: Reload firewalld to apply changes
#   ansible.builtin.shell: firewall-cmd --reload
#   when: configure_firewall | default(true)

# - name: Verify Kubernetes service is active
#   ansible.builtin.shell: firewall-cmd --list-services
#   register: active_services
#   when: configure_firewall | default(true)

# - name: Display active firewall services
#   ansible.builtin.debug:
#     msg: "Active firewall services: {{ active_services.stdout }}"
#   when: configure_firewall | default(true)

# - name: Install DNF plugins core for managing repositories
#   ansible.builtin.dnf:
#     name: dnf-plugins-core
#     state: present

# - name: Add Docker CE repository
#   ansible.builtin.shell: |
#     curl -fsSL https://download.docker.com/linux/fedora/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo

# - name: Install containerd
#   ansible.builtin.dnf:
#     name: containerd
#     state: present

# - name: Create containerd config directory
#   ansible.builtin.file:
#     path: /etc/containerd
#     state: directory
#     owner: root
#     group: root
#     mode: '0755'

# - name: Generate default containerd config and enable SystemdCgroup
#   ansible.builtin.shell: |
#     containerd config default > /etc/containerd/config.toml
#     sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml

# - name: Restart and enable containerd service
#   ansible.builtin.systemd:
#     name: containerd
#     state: restarted
#     enabled: true

# - name: Add Kubernetes repository
#   ansible.builtin.template:
#     dest: /etc/yum.repos.d/kubernetes.repo
#     owner: root
#     group: root
#     mode: '0644'
#     src: kubernetes.repo.j2

# - name: Install Kubernetes packages
#   ansible.builtin.dnf:
#     name:
#       - kubelet
#       - kubeadm
#       - kubectl
#       - kubernetes-cni
#     state: present

# - name: Create kubelet config directory
#   ansible.builtin.file:
#     path: /var/lib/kubelet
#     state: directory
#     owner: root
#     group: root
#     mode: '0755'

# - name: Create initial kubelet config file
#   ansible.builtin.copy:
#     dest: /var/lib/kubelet/config.yaml
#     owner: root
#     group: root
#     mode: '0644'
#     content: |
#       apiVersion: kubelet.config.k8s.io/v1beta1
#       kind: KubeletConfiguration
#       cgroupDriver: systemd
#       containerRuntimeEndpoint: unix:///run/containerd/containerd.sock

# - name: Install CNI plugins via dnf
#   ansible.builtin.dnf:
#     name: containernetworking-plugins
#     state: present

# - name: Verify CNI plugins installation
#   ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
#   register: cni_plugins
#   ignore_errors: true

# - name: Display installed CNI plugins
#   ansible.builtin.debug:
#     msg: "CNI plugins status: {{ cni_plugins.stdout }}"

# - name: Enable kubelet service (but don't start yet)
#   ansible.builtin.systemd:
#     name: kubelet
#     enabled: true
#     state: stopped