117 lines
2.9 KiB
YAML
117 lines
2.9 KiB
YAML
---
|
|
# Role to set/install Kubernetes prerequisites
|
|
|
|
- name: 1. Set Kubernetes-compatible hostname
|
|
ansible.builtin.hostname:
|
|
name: "{{ kubernetes_hostnames[inventory_hostname] | default(inventory_hostname) }}"
|
|
|
|
- name: 2. Disable swap
|
|
ansible.builtin.include_role:
|
|
name: no-swap
|
|
|
|
- name: 3. Manage SELinux
|
|
become: true
|
|
when: ansible_os_family == "RedHat"
|
|
block:
|
|
- name: 3.1 Install python3-libselinux for managing selinux
|
|
ansible.builtin.dnf:
|
|
name: python3-libselinux
|
|
state: present
|
|
|
|
- name: 3.2 Set SELinux to permissive mode
|
|
ansible.posix.selinux:
|
|
policy: targeted
|
|
state: "{{ selinux_state }}"
|
|
|
|
- name: 4 Manage Time Synchronization
|
|
ansible.builtin.include_role:
|
|
name: time-sync
|
|
|
|
- name: 5.1 Manage firewall (ufw)
|
|
become: true
|
|
when: ansible_os_family == "Debian"
|
|
block:
|
|
- name: 5.1.1 Install ufw
|
|
ansible.builtin.package:
|
|
name: ufw
|
|
state: present
|
|
|
|
- name: 5.1.2 Open firewall ports OpenSSH
|
|
community.general.ufw:
|
|
rule: allow
|
|
name: OpenSSH
|
|
|
|
- name: 5.1.3 Enable ufw
|
|
community.general.ufw:
|
|
state: enabled
|
|
|
|
- name: 5.2 Manage firewall (firewalld)
|
|
become: true
|
|
when: ansible_os_family == "RedHat"
|
|
block:
|
|
- name: 5.2.1 Install firewalld
|
|
ansible.builtin.package:
|
|
name: firewalld
|
|
state: present
|
|
|
|
- name: 5.2.2 Add SSH service to default zone (ensure SSH access)
|
|
ansible.posix.firewalld:
|
|
service: ssh
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
|
|
- name: 5.2.3 Start and enable firewalld
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: 6 Install kubernetes
|
|
ansible.builtin.include_role:
|
|
name: kubernetes
|
|
|
|
- name: 7 Install containerd
|
|
ansible.builtin.include_role:
|
|
name: containerd
|
|
|
|
# - name: Create kubelet config directory
|
|
# ansible.builtin.file:
|
|
# path: /var/lib/kubelet
|
|
# state: directory
|
|
# owner: root
|
|
# group: root
|
|
# mode: '0755'
|
|
|
|
# - name: Create initial kubelet config file
|
|
# ansible.builtin.copy:
|
|
# dest: /var/lib/kubelet/config.yaml
|
|
# owner: root
|
|
# group: root
|
|
# mode: '0644'
|
|
# content: |
|
|
# apiVersion: kubelet.config.k8s.io/v1beta1
|
|
# kind: KubeletConfiguration
|
|
# cgroupDriver: systemd
|
|
# containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
|
|
|
|
# - name: Install CNI plugins via dnf
|
|
# ansible.builtin.dnf:
|
|
# name: containernetworking-plugins
|
|
# state: present
|
|
|
|
# - name: Verify CNI plugins installation
|
|
# ansible.builtin.shell: ls -la /opt/cni/bin/ || echo "CNI plugins not found in /opt/cni/bin/"
|
|
# register: cni_plugins
|
|
# ignore_errors: true
|
|
|
|
# - name: Display installed CNI plugins
|
|
# ansible.builtin.debug:
|
|
# msg: "CNI plugins status: {{ cni_plugins.stdout }}"
|
|
|
|
# - name: Enable kubelet service (but don't start yet)
|
|
# ansible.builtin.systemd:
|
|
# name: kubelet
|
|
# enabled: true
|
|
# state: stopped
|