jaydee/ansible
1
0
Fork 0
mirror of https://gitlab.sectorq.eu/jaydee/ansible.git synced 2026-09-08 21:27:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

build

Browse Source
This commit is contained in:
jaydee
2026-05-21 13:18:24 +02:00
parent 9184deef93
commit e9d5f256b7
1 changed files with 75 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/kubernetes/tasks/Rocky.yml
+75 -56
View File
@@ -156,36 +156,45 @@
name: kubelet name: kubelet
enabled: yes enabled: yes
state: started state: started
# - name: Ensure firewalld is running
# ansible.builtin.service:
# name: firewalld
# state: started
# enabled: true
# when: inventory_hostname.endswith('-vm01.home.lan')
# - name: Open Kubernetes API server port (6443) - name: Ensure firewalld is running
# ansible.posix.firewalld: ansible.builtin.service:
# port: 6443/tcp name: firewalld
# permanent: yes state: started
# state: enabled enabled: true
# immediate: yes when:
# when: inventory_hostname.endswith('-vm01.home.lan') - inventory_hostname.endswith('-vm01.home.lan')
- "'firewalld' in ansible_facts.packages"
- name: Open Kubernetes API server port (6443)
ansible.posix.firewalld:
port: 6443/tcp
permanent: yes
state: enabled
immediate: yes
when:
- inventory_hostname.endswith('-vm01.home.lan')
- "'firewalld' in ansible_facts.packages"
# - name: Open etcd ports (2379-2380)
# ansible.posix.firewalld:
# port: 2379-2380/tcp
# permanent: yes
# state: enabled
# immediate: yes
# when: inventory_hostname.endswith('-vm01.home.lan')
# - name: Open kubelet and scheduler ports (10250-10252) - name: Open etcd ports (2379-2380)
# ansible.posix.firewalld: ansible.posix.firewalld:
# port: 10250-10252/tcp port: 2379-2380/tcp
# permanent: yes permanent: yes
# state: enabled state: enabled
# immediate: yes immediate: yes
when:
- inventory_hostname.endswith('-vm01.home.lan')
- "'firewalld' in ansible_facts.packages"
- name: Open kubelet and scheduler ports (10250-10252)
ansible.posix.firewalld:
port: 10250-10252/tcp
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
- name: Restart containerd - name: Restart containerd
systemd: systemd:
@@ -305,39 +314,49 @@
loop: "{{ aliases | dict2items }}" loop: "{{ aliases | dict2items }}"
when: inventory_hostname.endswith('-vm01.home.lan') when: inventory_hostname.endswith('-vm01.home.lan')
# - name: Allow TCP 10250 from 192.168.77.0/24 - name: Allow TCP 10250 from 192.168.77.0/24
# firewalld: firewalld:
# rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept' rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept'
# permanent: yes permanent: yes
# state: enabled state: enabled
# immediate: yes immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
# - name: Allow UDP 8472 from 192.168.77.0/24 - name: Allow UDP 8472 from 192.168.77.0/24
# firewalld: firewalld:
# rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept' rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept'
# permanent: yes permanent: yes
# state: enabled state: enabled
# immediate: yes immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
- name: Add flannel.1 interface to trusted zone
firewalld:
rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept' # interface handling is tricky with rich_rule
permanent: yes
state: enabled
immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
# - name: Add flannel.1 interface to trusted zone - name: Add cni0 interface to trusted zone
# firewalld: firewalld:
# rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept' # interface handling is tricky with rich_rule rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'
# permanent: yes permanent: yes
# state: enabled state: enabled
# immediate: yes immediate: yes
when:
- "'firewalld' in ansible_facts.packages"
# - name: Add cni0 interface to trusted zone - name: Ensure firewalld is restarted
# firewalld: ansible.builtin.service:
# rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept' name: firewalld
# permanent: yes state: stopped
# state: enabled enabled: false
# immediate: yes when:
- "'firewalld' in ansible_facts.packages"
# - name: Ensure firewalld is restarted
# ansible.builtin.service:
# name: firewalld
# state: stopped
# enabled: false
# ---------------------------- # ----------------------------
# 1. Install Helm v3 # 1. Install Helm v3
# ---------------------------- # ----------------------------