---
- name: Prerequisites | Set hostname
  ansible.builtin.hostname:
    name: "{{ inventory_hostname }}"

- name: Prerequisites | Add hostname to /etc/hosts
  ansible.builtin.lineinfile:
    path: /etc/hosts
    line: "{{ ansible_host }} {{ inventory_hostname }}"
    regexp: ".*{{ inventory_hostname }}$"
    state: present

- name: Prerequisites | Disable swap permanently
  ansible.builtin.replace:
    path: /etc/fstab
    regexp: '^([^#].*\s+swap\s+.*)$'
    replace: '# \1'

- name: Prerequisites | Disable swap now
  ansible.builtin.command: swapoff -a
  changed_when: false

- name: Prerequisites | Set SELinux to permissive
  ansible.posix.selinux:
    policy: targeted
    state: permissive

- name: Prerequisites | Load kernel modules (persistent)
  ansible.builtin.copy:
    dest: /etc/modules-load.d/k8s.conf
    content: |
      overlay
      br_netfilter
    mode: "0644"

- name: Prerequisites | Load kernel modules now
  community.general.modprobe:
    name: "{{ item }}"
    state: present
  loop:
    - overlay
    - br_netfilter

- name: Prerequisites | Set sysctl params
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    sysctl_file: /etc/sysctl.d/k8s.conf
    reload: true
  loop:
    - { key: "net.bridge.bridge-nf-call-iptables", value: "1" }
    - { key: "net.bridge.bridge-nf-call-ip6tables", value: "1" }
    - { key: "net.ipv4.ip_forward", value: "1" }

- name: Prerequisites | Ensure firewalld is running
  ansible.builtin.systemd:
    name: firewalld
    state: started
    enabled: true
    daemon_reload: true

- name: Prerequisites | Open worker firewall ports
  ansible.posix.firewalld:
    port: "{{ item }}"
    permanent: true
    state: enabled
    immediate: "{{ not ansible_check_mode }}"
  loop:
    - 10250/tcp      # kubelet API
    - 10256/tcp      # kube-proxy healthz
    - 30000-32767/tcp  # NodePort services
    - 8472/udp       # Flannel VXLAN

- name: Prerequisites | Trust overlay interfaces in firewalld
  ansible.posix.firewalld:
    interface: "{{ item }}"
    zone: trusted
    permanent: true
    state: enabled
    immediate: "{{ not ansible_check_mode }}"
  loop:
    - flannel.1
    - cni0

- name: Prerequisites | Trust pod and service CIDRs in firewalld
  ansible.posix.firewalld:
    source: "{{ item }}"
    zone: trusted
    permanent: true
    state: enabled
    immediate: "{{ not ansible_check_mode }}"
  loop:
    - "{{ pod_network_cidr }}"
    - "{{ service_cidr }}"