ansible/roles/kubernetes/tasks/Rocky.yml

- name: Install kubernetes on Rocky 9
  become: "{{ 'no' if inventory_hostname == 'nas.home.lan' else 'yes' }}"
  block:

    - name: Include role proxy_repo
      ansible.builtin.include_role:
        name: proxy_repo

    - name: Include role local mirror
      ansible.builtin.include_role:
        name: mirror_repo     
      when: use_local_repo | default(false)


    - name: Disable SELinux
      ansible.posix.selinux:
        state: permissive
        policy: targeted

    - name: Disable swap
      command: swapoff -a
      when: ansible_swaptotal_mb > 0

    - name: Remove swap from fstab
      replace:
        path: /etc/fstab
        regexp: '.*swap.*'
        replace: ''

    - name: Enable kernel modules
      copy:
        dest: /etc/modules-load.d/k8s.conf
        content: |
          overlay
          br_netfilter

    - name: Load kernel modules
      shell: |
        modprobe overlay
        modprobe br_netfilter

    - name: Set sysctl params
      copy:
        dest: /etc/sysctl.d/k8s.conf
        content: |
          net.bridge.bridge-nf-call-iptables = 1
          net.bridge.bridge-nf-call-ip6tables = 1
          net.ipv4.ip_forward = 1

    - name: Apply sysctl
      command: sysctl --system

    - name: Install required packages
      dnf:
        name:
          - yum-utils
          - device-mapper-persistent-data
          - lvm2
          - epel-release
          - git
        state: present

    - name: Add Kubernetes repo
      copy:
        dest: /etc/yum.repos.d/kubernetes.repo
        content: |
          [kubernetes]
          name=Kubernetes
          baseurl=http://pkgs.k8s.io/core:/stable:/v1.29/rpm/
          enabled=1
          gpgcheck=1
          gpgkey=http://pkgs.k8s.io/core:/stable:/v1.29/rpm/repodata/repomd.xml.key

    - name: Add Docker CE repository
      get_url:
        url: http://download.docker.com/linux/centos/docker-ce.repo
        dest: /etc/yum.repos.d/docker-ce.repo
        mode: '0644'
    - name: Remove Docker containerd if present
      dnf:
        name:
          - containerd.io
          - docker-ce
          - docker-ce-cli
        state: absent
      ignore_errors: true

    - name: Install containerd
      dnf:
        name: containerd.io
        state: present

    - name: Configure containerd
      shell: |
        mkdir -p /etc/containerd
        containerd config default > /etc/containerd/config.toml
        sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml

    - name: Enable and start containerd
      systemd:
        name: containerd
        enabled: yes
        state: started

    - name: Wait for containerd socket
      ansible.builtin.wait_for:
        path: /run/containerd/containerd.sock
        state: present
        timeout: 30

    - name: Install Kubernetes packages
      dnf:
        name:
          - kubelet
          - kubeadm
          - kubectl
        disable_excludes: kubernetes
        state: present
      register: k8s_install
      retries: 5
      delay: 10
      until: k8s_install is succeeded

    - name: Enable kubelet
      systemd:
        name: kubelet
        enabled: yes
        state: started
    - name: Ensure firewalld is running
      ansible.builtin.service:
        name: firewalld
        state: started
        enabled: true
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Open Kubernetes API server port (6443)
      ansible.posix.firewalld:
        port: 6443/tcp
        permanent: yes
        state: enabled
        immediate: yes
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Open etcd ports (2379-2380)
      ansible.posix.firewalld:
        port: 2379-2380/tcp
        permanent: yes
        state: enabled
        immediate: yes
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Open kubelet and scheduler ports (10250-10252)
      ansible.posix.firewalld:
        port: 10250-10252/tcp
        permanent: yes
        state: enabled
        immediate: yes


    - name: Restart containerd
      systemd:
        name: containerd
        state: restarted

    - name: Initialize Kubernetes
      command: kubeadm init --pod-network-cidr=10.244.0.0/16
      args:
        creates: /etc/kubernetes/admin.conf
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Wait for Kubernetes API to be available
      wait_for:
        host: 127.0.0.1
        port: 6443
        delay: 10
        timeout: 300
        state: started
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Create .kube directory
      file:
        path: /home/{{ ansible_user }}/.kube
        state: directory
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0755'

    - name: Copy kubeconfig to user
      copy:
        remote_src: yes
        src: /etc/kubernetes/admin.conf
        dest: /home/{{ ansible_user }}/.kube/config
        owner: "{{ ansible_user }}"
        group: "{{ ansible_user }}"
        mode: '0644'
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Install Flannel CNI
      become_user: "{{ ansible_user }}"
      command: kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Get join command
      command: kubeadm token create --print-join-command
      register: join_command
      when: inventory_hostname.endswith('-vm01.home.lan')


      
    - name: Save join command
      set_fact:
        worker_join_cmd: "sudo {{ join_command.stdout }}"
      when: inventory_hostname.endswith('-vm01.home.lan')


    - name: Print join command
      debug:
        msg: "{{ worker_join_cmd }}"
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Wait for Kubernetes API
      uri:
        url: https://localhost:6443/healthz
        method: GET
        status_code: 200
        validate_certs: no
      register: api_health
      until: api_health.status == 200
      retries: 10
      delay: 15
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Join cluster
      command: >-
        {{ hostvars['rocky' ~ ansible_distribution_major_version ~ '-vm01.home.lan'].worker_join_cmd }}
      args:
        creates: /etc/kubernetes/kubelet.conf
      when: not inventory_hostname.endswith('-vm01.home.lan')

    - name: get repository
      git: 
        repo: 'https://github.com/ahmetb/kubectx'
        dest: /opt/kubectx
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Create symbolic links for kubectx and kubens
      file:
        src: /opt/kubectx/{{ item }}
        dest: /usr/local/bin/{{ item }}
        state: link
      loop:
        - kubectx
        - kubens
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Install Additional packages
      dnf:
        name:
          - nfs-utils
          - tmux
          - telnet
        state: present

    - name: Ensure aliases exist in user's .bashrc
      lineinfile:
        path: "/home/{{ user_name }}/.bashrc"
        line: "alias {{ item.key }}='{{ item.value }}'"
        state: present
        create: yes
      loop: "{{ aliases | dict2items }}"
      when: inventory_hostname.endswith('-vm01.home.lan')

    - name: Allow TCP 10250 from 192.168.77.0/24
      firewalld:
        rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="10250" protocol="tcp" accept'
        permanent: yes
        state: enabled
        immediate: yes

    - name: Allow UDP 8472 from 192.168.77.0/24
      firewalld:
        rich_rule: 'rule family="ipv4" source address="192.168.77.0/24" port port="8472" protocol="udp" accept'
        permanent: yes
        state: enabled
        immediate: yes

    - name: Add flannel.1 interface to trusted zone
      firewalld:
        rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'   # interface handling is tricky with rich_rule
        permanent: yes
        state: enabled
        immediate: yes

    - name: Add cni0 interface to trusted zone
      firewalld:
        rich_rule: 'rule family="ipv4" source NOT address="0.0.0.0/0" accept'
        permanent: yes
        state: enabled
        immediate: yes

    - name: Ensure firewalld is restarted
      ansible.builtin.service:
        name: firewalld
        state: stopped
        enabled: false