95 lines
2.4 KiB
YAML
95 lines
2.4 KiB
YAML
---
|
|
- name: Prerequisites | Set hostname
|
|
ansible.builtin.hostname:
|
|
name: "{{ inventory_hostname }}"
|
|
|
|
- name: Prerequisites | Add hostname to /etc/hosts
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/hosts
|
|
line: "{{ ansible_host }} {{ inventory_hostname }}"
|
|
regexp: ".*{{ inventory_hostname }}$"
|
|
state: present
|
|
|
|
- name: Prerequisites | Disable swap permanently
|
|
ansible.builtin.replace:
|
|
path: /etc/fstab
|
|
regexp: '^([^#].*\s+swap\s+.*)$'
|
|
replace: '# \1'
|
|
|
|
- name: Prerequisites | Disable swap now
|
|
ansible.builtin.command: swapoff -a
|
|
changed_when: false
|
|
|
|
- name: Prerequisites | Set SELinux to permissive
|
|
ansible.posix.selinux:
|
|
policy: targeted
|
|
state: permissive
|
|
|
|
- name: Prerequisites | Load kernel modules (persistent)
|
|
ansible.builtin.copy:
|
|
dest: /etc/modules-load.d/k8s.conf
|
|
content: |
|
|
overlay
|
|
br_netfilter
|
|
mode: "0644"
|
|
|
|
- name: Prerequisites | Load kernel modules now
|
|
community.general.modprobe:
|
|
name: "{{ item }}"
|
|
state: present
|
|
loop:
|
|
- overlay
|
|
- br_netfilter
|
|
|
|
- name: Prerequisites | Set sysctl params
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: /etc/sysctl.d/k8s.conf
|
|
reload: true
|
|
loop:
|
|
- { key: "net.bridge.bridge-nf-call-iptables", value: "1" }
|
|
- { key: "net.bridge.bridge-nf-call-ip6tables", value: "1" }
|
|
- { key: "net.ipv4.ip_forward", value: "1" }
|
|
|
|
- name: Prerequisites | Ensure firewalld is running
|
|
ansible.builtin.systemd:
|
|
name: firewalld
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|
|
|
|
- name: Prerequisites | Open worker firewall ports
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
state: enabled
|
|
immediate: "{{ not ansible_check_mode }}"
|
|
loop:
|
|
- 10250/tcp # kubelet API
|
|
- 10256/tcp # kube-proxy healthz
|
|
- 30000-32767/tcp # NodePort services
|
|
- 8472/udp # Flannel VXLAN
|
|
|
|
- name: Prerequisites | Trust overlay interfaces in firewalld
|
|
ansible.posix.firewalld:
|
|
interface: "{{ item }}"
|
|
zone: trusted
|
|
permanent: true
|
|
state: enabled
|
|
immediate: "{{ not ansible_check_mode }}"
|
|
loop:
|
|
- flannel.1
|
|
- cni0
|
|
|
|
- name: Prerequisites | Trust pod and service CIDRs in firewalld
|
|
ansible.posix.firewalld:
|
|
source: "{{ item }}"
|
|
zone: trusted
|
|
permanent: true
|
|
state: enabled
|
|
immediate: "{{ not ansible_check_mode }}"
|
|
loop:
|
|
- "{{ pod_network_cidr }}"
|
|
- "{{ service_cidr }}"
|