mrwho
b32ea30345
- rename manager node and update host FQDNs in inventory - enable multiple worker nodes by commenting out secondary disk - standardize k8s configuration file paths with numeric prefixes - disable k9s permissions step in manager role - upgrade Longhorn chart to v1.12.0 and Traefik chart to v41.0.2 - update Traefik port_map with protocol and add forgejo service - refine Traefik logging configuration to use new JSON format - increase Longhorn disk probe retries and delays - add placeholder directory for k8s_manager files
105 lines
3.1 KiB
YAML
105 lines
3.1 KiB
YAML
---
|
|
- name: Prerequisites | Set hostname
|
|
ansible.builtin.hostname:
|
|
name: "{{ inventory_hostname }}"
|
|
|
|
- name: Prerequisites | Add hostname to /etc/hosts
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
line: "{{ ansible_host }} {{ inventory_hostname }}"
|
|
regexp: ".*{{ inventory_hostname }}$"
|
|
state: present
|
|
|
|
- name: Prerequisites | Disable swap permanently
|
|
ansible.builtin.replace:
|
|
path: /etc/fstab
|
|
regexp: '^([^#].*\s+swap\s+.*)$'
|
|
replace: '# \1'
|
|
|
|
- name: Prerequisites | Disable swap now
|
|
ansible.builtin.command: swapoff -a
|
|
changed_when: false
|
|
|
|
- name: Prerequisites | Set SELinux to permissive
|
|
ansible.posix.selinux:
|
|
policy: targeted
|
|
state: permissive
|
|
|
|
- name: Prerequisites | Load kernel modules (persistent)
|
|
ansible.builtin.copy:
|
|
dest: /etc/modules-load.d/99-k8s.conf
|
|
content: |
|
|
overlay
|
|
br_netfilter
|
|
mode: "0644"
|
|
|
|
- name: Prerequisites | Load kernel modules now
|
|
community.general.modprobe:
|
|
name: "{{ item }}"
|
|
state: present
|
|
loop:
|
|
- overlay
|
|
- br_netfilter
|
|
|
|
- name: Prerequisites | Set sysctl params
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: /etc/sysctl.d/99-k8s.conf
|
|
reload: true
|
|
loop:
|
|
- { key: "net.bridge.bridge-nf-call-iptables", value: "1" }
|
|
- { key: "net.bridge.bridge-nf-call-ip6tables", value: "1" }
|
|
- { key: "net.ipv4.ip_forward", value: "1" }
|
|
|
|
# Fix #9: ensure firewalld is running before opening ports
|
|
- name: Prerequisites | Ensure firewalld is running
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Prerequisites | Open control plane firewall ports
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: "{{ not ansible_check_mode }}"
|
|
loop:
|
|
- 6443/tcp # kube-apiserver
|
|
- 2379-2380/tcp # etcd
|
|
- 10250/tcp # kubelet API
|
|
- 10251/tcp # kube-scheduler
|
|
- 10252/tcp # kube-controller-manager
|
|
- 10257/tcp # kube-controller-manager (secure)
|
|
- 10259/tcp # kube-scheduler (secure)
|
|
- 8472/udp # Flannel VXLAN (fix #4: required for pod-to-pod traffic across nodes)
|
|
|
|
- name: Prerequisites | Trust overlay interfaces in firewalld
|
|
ansible.posix.firewalld:
|
|
interface: "{{ item }}"
|
|
zone: trusted
|
|
permanent: true
|
|
state: enabled
|
|
immediate: "{{ not ansible_check_mode }}"
|
|
loop:
|
|
- flannel.1
|
|
- cni0
|
|
|
|
# Interface-based rules above only work when the interface already exists at
|
|
# firewalld reload time. Flannel creates flannel.1/cni0 dynamically (no
|
|
# NetworkManager integration), so they may not be in the trusted zone after
|
|
# a fresh boot. Source-based CIDR rules are reliable regardless of interface
|
|
# lifecycle and cover all pod-to-pod and service traffic.
|
|
- name: Prerequisites | Trust pod and service CIDRs in firewalld
|
|
ansible.posix.firewalld:
|
|
source: "{{ item }}"
|
|
zone: trusted
|
|
permanent: true
|
|
state: enabled
|
|
immediate: "{{ not ansible_check_mode }}"
|
|
loop:
|
|
- "{{ pod_network_cidr }}"
|
|
- "{{ service_cidr }}"
|