From 59e6c3ca631b33bb169712df6e971a9ef66d9d00 Mon Sep 17 00:00:00 2001 From: Vezpi Date: Wed, 9 Sep 2026 20:34:37 +0000 Subject: [PATCH] add: ansible k8s_node role --- .../kubernetes/collections/requirements.yml | 3 +- ansible/kubernetes/k8s_node.yml | 6 +++ .../roles/k8s_node/defaults/main.yml | 28 ++++++++++ .../roles/k8s_node/tasks/containerd.yml | 34 +++++++++++++ .../roles/k8s_node/tasks/firewall.yml | 44 ++++++++++++++++ .../kubernetes/roles/k8s_node/tasks/main.yml | 5 ++ .../roles/k8s_node/tasks/packages.yml | 36 +++++++++++++ .../roles/k8s_node/tasks/system.yml | 51 +++++++++++++++++++ 8 files changed, 206 insertions(+), 1 deletion(-) create mode 100644 ansible/kubernetes/k8s_node.yml create mode 100644 ansible/kubernetes/roles/k8s_node/defaults/main.yml create mode 100644 ansible/kubernetes/roles/k8s_node/tasks/containerd.yml create mode 100644 ansible/kubernetes/roles/k8s_node/tasks/firewall.yml create mode 100644 ansible/kubernetes/roles/k8s_node/tasks/main.yml create mode 100644 ansible/kubernetes/roles/k8s_node/tasks/packages.yml create mode 100644 ansible/kubernetes/roles/k8s_node/tasks/system.yml diff --git a/ansible/kubernetes/collections/requirements.yml b/ansible/kubernetes/collections/requirements.yml index 7c67e70..fc84c67 100644 --- a/ansible/kubernetes/collections/requirements.yml +++ b/ansible/kubernetes/collections/requirements.yml @@ -1,3 +1,4 @@ --- collections: - - name: cloud.terraform \ No newline at end of file + - name: cloud.terraform + - name: community.general \ No newline at end of file diff --git a/ansible/kubernetes/k8s_node.yml b/ansible/kubernetes/k8s_node.yml new file mode 100644 index 0000000..c999c49 --- /dev/null +++ b/ansible/kubernetes/k8s_node.yml @@ -0,0 +1,6 @@ +--- +- name: Prepare Kubernetes nodes + hosts: all + + roles: + - role: k8s_node \ No newline at end of file diff --git a/ansible/kubernetes/roles/k8s_node/defaults/main.yml b/ansible/kubernetes/roles/k8s_node/defaults/main.yml new file mode 100644 index 0000000..249acb4 --- /dev/null +++ b/ansible/kubernetes/roles/k8s_node/defaults/main.yml @@ -0,0 +1,28 @@ +--- +k8s_version: "1.37" + +k8s_repo: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_version }}/deb" +k8s_repo_key: "https://pkgs.k8s.io/core:/stable:/v{{ k8s_version }}/deb/Release.key" + +k8s_packages: + - kubelet + - kubeadm + +k8s_prerequisite_packages: + - apt-transport-https + - ca-certificates + - curl + - gnupg + +k8s_firewall_admin_subnet: "192.168.66.0/24" +k8s_firewall_ssh_port: "22" +k8s_firewall_common_ports: + - "6443" + - "10250" +k8s_firewall_master_ports: + - "2379:2380" + - "10257" + - "10259" +k8s_firewall_worker_ports: + - "10256" + - "30000:32767" \ No newline at end of file diff --git a/ansible/kubernetes/roles/k8s_node/tasks/containerd.yml b/ansible/kubernetes/roles/k8s_node/tasks/containerd.yml new file mode 100644 index 0000000..5f0d65d --- /dev/null +++ b/ansible/kubernetes/roles/k8s_node/tasks/containerd.yml @@ -0,0 +1,34 @@ +--- +- name: Install containerd + ansible.builtin.apt: + name: containerd + state: present + update_cache: true + become: yes + +- name: Create containerd configuration directory + ansible.builtin.file: + path: /etc/containerd + state: directory + mode: "0755" + become: yes + +- name: Generate default containerd configuration + ansible.builtin.shell: + cmd: containerd config default > /etc/containerd/config.toml + creates: /etc/containerd/config.toml + become: yes + +- name: Enable systemd cgroup driver in containerd + ansible.builtin.replace: + path: /etc/containerd/config.toml + regexp: '^(\s*)SystemdCgroup(\s*=\s*)false' + replace: '\1SystemdCgroup\2true' + become: yes + +- name: Enable and start containerd + ansible.builtin.systemd: + name: containerd + state: restarted + enabled: true + become: yes \ No newline at end of file diff --git a/ansible/kubernetes/roles/k8s_node/tasks/firewall.yml b/ansible/kubernetes/roles/k8s_node/tasks/firewall.yml new file mode 100644 index 0000000..9f315ed --- /dev/null +++ b/ansible/kubernetes/roles/k8s_node/tasks/firewall.yml @@ -0,0 +1,44 @@ +--- +- name: Allow SSH from admin subnet + community.general.ufw: + rule: allow + port: "{{ k8s_firewall_ssh_port }}" + proto: tcp + from_ip: "{{ k8s_firewall_admin_subnet }}" + become: yes + +- name: Allow common Kubernetes ports from admin subnet + community.general.ufw: + rule: allow + port: "{{ item }}" + proto: tcp + from_ip: "{{ k8s_firewall_admin_subnet }}" + become: yes + loop: "{{ k8s_firewall_common_ports }}" + +- name: Allow etcd and control plane ports on control-plane nodes + community.general.ufw: + rule: allow + port: "{{ item }}" + proto: tcp + from_ip: "{{ k8s_firewall_admin_subnet }}" + become: yes + loop: "{{ k8s_firewall_master_ports }}" + when: inventory_hostname in groups['master'] + +- name: Allow kube-proxy and NodePort ports on worker nodes + community.general.ufw: + rule: allow + port: "{{ item }}" + proto: tcp + from_ip: "{{ k8s_firewall_admin_subnet }}" + become: yes + loop: "{{ k8s_firewall_worker_ports }}" + when: inventory_hostname in groups['worker'] + +- name: Enable ufw and deny incoming by default + community.general.ufw: + state: enabled + policy: deny + direction: incoming + become: yes \ No newline at end of file diff --git a/ansible/kubernetes/roles/k8s_node/tasks/main.yml b/ansible/kubernetes/roles/k8s_node/tasks/main.yml new file mode 100644 index 0000000..1b0af9f --- /dev/null +++ b/ansible/kubernetes/roles/k8s_node/tasks/main.yml @@ -0,0 +1,5 @@ +--- +- ansible.builtin.import_tasks: system.yml +- ansible.builtin.import_tasks: packages.yml +- ansible.builtin.import_tasks: containerd.yml +- ansible.builtin.import_tasks: firewall.yml \ No newline at end of file diff --git a/ansible/kubernetes/roles/k8s_node/tasks/packages.yml b/ansible/kubernetes/roles/k8s_node/tasks/packages.yml new file mode 100644 index 0000000..a38b7c0 --- /dev/null +++ b/ansible/kubernetes/roles/k8s_node/tasks/packages.yml @@ -0,0 +1,36 @@ +--- +- name: Install prerequisite packages + ansible.builtin.apt: + name: "{{ k8s_prerequisite_packages }}" + state: present + update_cache: true + become: yes + +- name: Add Kubernetes apt key + ansible.builtin.apt_key: + url: "{{ k8s_repo_key }}" + keyring: /etc/apt/keyrings/kubernetes-apt-keyring.gpg + state: present + become: yes + +- name: Add Kubernetes apt repository + ansible.builtin.apt_repository: + repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] {{ k8s_repo }} /" + state: present + filename: kubernetes + become: yes + +- name: Install kubelet and kubeadm + ansible.builtin.apt: + name: "{{ k8s_packages }}" + state: present + update_cache: true + become: yes + +- name: Hold kubelet and kubeadm packages + ansible.builtin.command: + cmd: apt-mark hold {{ item }} + loop: "{{ k8s_packages }}" + register: _kube_hold + become: yes + changed_when: "'already set on hold' not in _kube_hold.stdout" \ No newline at end of file diff --git a/ansible/kubernetes/roles/k8s_node/tasks/system.yml b/ansible/kubernetes/roles/k8s_node/tasks/system.yml new file mode 100644 index 0000000..83dada1 --- /dev/null +++ b/ansible/kubernetes/roles/k8s_node/tasks/system.yml @@ -0,0 +1,51 @@ +--- +- name: Disable swap + ansible.builtin.shell: + cmd: swapoff -a + become: yes + changed_when: false + +- name: Comment out swap entries in fstab + ansible.builtin.replace: + path: /etc/fstab + regexp: '^(\s*[^#\s][^\s]*\s+swap\s+.*)$' + replace: '# \1' + become: yes + +- name: Load overlay kernel module + ansible.builtin.shell: + cmd: modprobe overlay + become: yes + changed_when: false + failed_when: false + +- name: Load br_netfilter kernel module + ansible.builtin.shell: + cmd: modprobe br_netfilter + become: yes + changed_when: false + +- name: Persist kernel modules + ansible.builtin.copy: + dest: /etc/modules-load.d/k8s.conf + content: | + overlay + br_netfilter + mode: "0644" + become: yes + +- name: Configure kernel network settings + ansible.builtin.copy: + dest: /etc/sysctl.d/k8s.conf + content: | + net.bridge.bridge-nf-call-iptables = 1 + net.bridge.bridge-nf-call-ip6tables = 1 + net.ipv4.ip_forward = 1 + mode: "0644" + become: yes + +- name: Apply kernel network settings + ansible.builtin.command: + cmd: sysctl --system + become: yes + changed_when: false \ No newline at end of file