initial commit

roles/k3s_install/tasks/main.yml

@@ -0,0 +1,132 @@
+---
+- name: Disable swap
+  ansible.builtin.command: swapoff -a
+  changed_when: true
+  tags: [k3s_install]
+
+- name: Remove swap entries from fstab
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^([^#].*\sswap\s.*)$'
+    replace: '# \1'
+  tags: [k3s_install]
+
+- name: Load required kernel modules
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - overlay
+    - br_netfilter
+  tags: [k3s_install]
+
+- name: Persist required kernel modules across reboots
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k3s.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      overlay
+      br_netfilter
+  tags: [k3s_install]
+
+- name: Set required sysctl parameters
+  ansible.posix.sysctl:
+    name: "{{ item.name }}"
+    value: "{{ item.value }}"
+    sysctl_set: true
+    state: present
+    reload: true
+  loop:
+    - { name: "net.bridge.bridge-nf-call-iptables", value: "1" }
+    - { name: "net.ipv4.ip_forward", value: "1" }
+  tags: [k3s_install]
+
+- name: Open firewall ports required by k3s
+  ansible.posix.firewalld:
+    zone: "{{ firewall_default_zone }}"
+    rich_rule: >-
+      rule family="ipv4" source address="{{ firewall_admin_subnet }}"
+      port protocol="{{ item.proto }}" port="{{ item.port }}" accept
+    permanent: true
+    immediate: true
+    state: enabled
+  loop:
+    - { port: "6443", proto: "tcp" }
+    - { port: "10250", proto: "tcp" }
+    - { port: "8472", proto: "udp" }
+    - { port: "{{ awx_operator_nodeport }}", proto: "tcp" }
+  tags: [k3s_install]
+
+- name: Install pip
+  ansible.builtin.dnf:
+    name: python3-pip
+    state: present
+  tags: [k3s_install]
+
+- name: Install the Python kubernetes client library
+  ansible.builtin.pip:
+    name: kubernetes
+    state: present
+  tags: [k3s_install]
+
+- name: Check whether k3s is already installed
+  ansible.builtin.stat:
+    path: /usr/local/bin/k3s
+  register: k3s_install_binary
+  tags: [k3s_install]
+
+- name: Download the k3s install script
+  ansible.builtin.get_url:
+    url: https://get.k3s.io
+    dest: /tmp/k3s-install.sh
+    mode: "0700"
+  when: not k3s_install_binary.stat.exists
+  tags: [k3s_install]
+
+- name: Run the k3s install script
+  ansible.builtin.command: /tmp/k3s-install.sh
+  environment:
+    INSTALL_K3S_VERSION: "{{ k3s_version }}"
+    INSTALL_K3S_EXEC: "server {{ '--disable traefik' if k3s_disable_traefik else '' }}"
+  when: not k3s_install_binary.stat.exists
+  changed_when: true
+  tags: [k3s_install]
+
+- name: Remove the k3s install script
+  ansible.builtin.file:
+    path: /tmp/k3s-install.sh
+    state: absent
+  tags: [k3s_install]
+
+- name: Enable and start k3s
+  ansible.builtin.systemd:
+    name: k3s
+    enabled: true
+    state: started
+  tags: [k3s_install]
+
+- name: Wait for the Kubernetes API to accept connections
+  ansible.builtin.wait_for:
+    port: 6443
+    host: 127.0.0.1
+    timeout: 180
+  tags: [k3s_install]
+
+- name: Wait for the node to reach Ready status
+  ansible.builtin.command: /usr/local/bin/k3s kubectl wait node --for=condition=Ready --all --timeout=180s
+  register: k3s_install_node_ready
+  changed_when: false
+  retries: 3
+  delay: 15
+  until: k3s_install_node_ready.rc == 0
+  tags: [k3s_install]
+
+- name: Make the kubeconfig readable for subsequent Kubernetes modules
+  ansible.builtin.file:
+    path: /etc/rancher/k3s/k3s.yaml
+    owner: root
+    group: root
+    mode: "0600"
+  tags: [k3s_install]