diff --git a/ansible/playbooks/01-common.yml b/ansible/playbooks/01-common.yml
index 86bb7ee..473b81e 100644
--- a/ansible/playbooks/01-common.yml
+++ b/ansible/playbooks/01-common.yml
@@ -3,7 +3,46 @@
   hosts: k8s
   become: true
 
+  vars:
+    timezone: Asia/Ho_Chi_Minh   # GMT+7
+
   tasks:
+    # ── Timezone + NTP ────────────────────────────────────────────────
+    - name: Set timezone
+      community.general.timezone:
+        name: "{{ timezone }}"
+
+    - name: Ensure chrony is installed
+      dnf:
+        name: chrony
+        state: present
+
+    - name: Enable and start chronyd
+      systemd:
+        name: chronyd
+        enabled: true
+        state: started
+
+    # ── SELinux ───────────────────────────────────────────────────────
+    - name: Set SELinux to permissive (runtime)
+      command: setenforce 0
+      ignore_errors: true   # already permissive/disabled is fine
+
+    - name: Set SELinux to permissive (persistent)
+      replace:
+        path: /etc/selinux/config
+        regexp: '^SELINUX=enforcing'
+        replace: 'SELINUX=permissive'
+
+    # ── Firewalld ─────────────────────────────────────────────────────
+    - name: Disable and stop firewalld
+      systemd:
+        name: firewalld
+        enabled: false
+        state: stopped
+      ignore_errors: true   # may not be installed
+
+    # ── Swap ──────────────────────────────────────────────────────────
     - name: Disable swap now
       command: swapoff -a
       when: ansible_facts['swaptotal_mb'] > 0
@@ -14,6 +53,7 @@
         regexp: '^([^#].*\s+swap\s+.*)$'
         replace: '# \1'
 
+    # ── Kernel modules ────────────────────────────────────────────────
     - name: Load kernel modules at boot
       copy:
         dest: /etc/modules-load.d/k8s.conf
@@ -28,6 +68,7 @@
         - overlay
         - br_netfilter
 
+    # ── sysctl ────────────────────────────────────────────────────────
     - name: Set sysctl for k8s networking
       copy:
         dest: /etc/sysctl.d/k8s.conf
@@ -38,3 +79,9 @@
 
     - name: Apply sysctl
       command: sysctl --system
+
+    # ── NFS client ────────────────────────────────────────────────────
+    - name: Install nfs-utils (required for NFS PVC mounts)
+      dnf:
+        name: nfs-utils
+        state: present