jaydee/ansible
1
0
Fork 0
mirror of https://gitlab.sectorq.eu/jaydee/ansible.git synced 2026-09-08 21:27:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

build

Browse Source
This commit is contained in:
jaydee
2026-05-21 13:18:24 +02:00
parent 9184deef93
commit e9d5f256b7
1 changed files with 75 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/kubernetes/tasks/Rocky.yml
+75 -56
View File
@@ -156,36 +156,45 @@
name: kubelet
enabled: yes
state: started
# - name: Ensure firewalld is running
# ansible.builtin.service:
# name: firewalld
# state: started
# enabled: true
# when: inventory_hostname.endswith('-vm01.home.lan')
# - name: Open Kubernetes API server port (6443)
# ansible.posix.firewalld:
# port: 6443/tcp
# permanent: yes
# state: enabled
# immediate: yes
# when: inventory_hostname.endswith('-vm01.home.lan')
- name: Ensure firewalld is running
ansible.builtin.service:
name: firewalld
state: started
enabled: true
when:
- inventory_hostname.endswith('-vm01.home.lan')
- "'firewalld' in ansible_facts.packages"
- name: Open Kubernetes API server port (6443)
ansible.posix.firewalld:
port: 6443/tcp
permanent: yes
state: enabled
immediate: yes
when:
- inventory_hostname.endswith('-vm01.home.lan')
- "'firewalld' in ansible_facts.packages"
# - name: Open etcd ports (2379-2380)
# ansible.posix.firewalld:
# port: 2379-2380/tcp
# permanent: yes
# state: enabled
# immediate: yes
# when: inventory_hostname.endswith('-vm01.home.lan')
# - name: Open kubelet and scheduler ports (10250-10252)
# ansible.posix.firewalld:
# port: 10250-10252/tcp
# permanent: yes
# state: enabled
# immediate: yes
- name: Open etcd ports (2379-2380)
ansible.posix.firewalld:
port: 2379-2380/tcp
permanent: yes
state: enabled
immediate: yes
when:
- inventory_hostname.endswith('-vm01.home.lan')
- "'firewalld' in ansible_facts.packages"
- name: Open kubelet and scheduler ports (10250-10252)
ansible.posix.firewalld:
port: 10250-10252/tcp
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
- name: Restart containerd
systemd:
@@ -305,39 +314,49 @@
loop: "{{ aliases | dict2items }}"
when: inventory_hostname.endswith('-vm01.home.lan')
# - name: Allow TCP 10250 from 192.168.77.0/24
# firewalld:
# rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept'
# permanent: yes
# state: enabled
# immediate: yes
- name: Allow TCP 10250 from 192.168.77.0/24
firewalld:
rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept'
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
# - name: Allow UDP 8472 from 192.168.77.0/24
# firewalld:
# rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept'
# permanent: yes
# state: enabled
# immediate: yes
- name: Allow UDP 8472 from 192.168.77.0/24
firewalld:
rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept'
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
- name: Add flannel.1 interface to trusted zone
firewalld:
rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept' # interface handling is tricky with rich_rule
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
# - name: Add flannel.1 interface to trusted zone
# firewalld:
# rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept' # interface handling is tricky with rich_rule
# permanent: yes
# state: enabled
# immediate: yes
- name: Add cni0 interface to trusted zone
firewalld:
rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
# - name: Add cni0 interface to trusted zone
# firewalld:
# rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'
# permanent: yes
# state: enabled
# immediate: yes
# - name: Ensure firewalld is restarted
# ansible.builtin.service:
# name: firewalld
# state: stopped
# enabled: false
- name: Ensure firewalld is restarted
ansible.builtin.service:
name: firewalld
state: stopped
enabled: false
when:
- "'firewalld' in ansible_facts.packages"
# ----------------------------
# 1. Install Helm v3
# ----------------------------