88 lines
3.1 KiB
YAML
88 lines
3.1 KiB
YAML
---
|
|
- name: Common OS prerequisites for all k8s nodes
|
|
hosts: k8s
|
|
become: true
|
|
|
|
vars:
|
|
timezone: Asia/Ho_Chi_Minh # GMT+7
|
|
|
|
tasks:
|
|
# ── Timezone + NTP ────────────────────────────────────────────────
|
|
- name: Set timezone
|
|
community.general.timezone:
|
|
name: "{{ timezone }}"
|
|
|
|
- name: Ensure chrony is installed
|
|
dnf:
|
|
name: chrony
|
|
state: present
|
|
|
|
- name: Enable and start chronyd
|
|
systemd:
|
|
name: chronyd
|
|
enabled: true
|
|
state: started
|
|
|
|
# ── SELinux ───────────────────────────────────────────────────────
|
|
- name: Set SELinux to permissive (runtime)
|
|
command: setenforce 0
|
|
ignore_errors: true # already permissive/disabled is fine
|
|
|
|
- name: Set SELinux to permissive (persistent)
|
|
replace:
|
|
path: /etc/selinux/config
|
|
regexp: '^SELINUX=enforcing'
|
|
replace: 'SELINUX=permissive'
|
|
|
|
# ── Firewalld ─────────────────────────────────────────────────────
|
|
- name: Disable and stop firewalld
|
|
systemd:
|
|
name: firewalld
|
|
enabled: false
|
|
state: stopped
|
|
ignore_errors: true # may not be installed
|
|
|
|
# ── Swap ──────────────────────────────────────────────────────────
|
|
- name: Disable swap now
|
|
command: swapoff -a
|
|
when: ansible_facts['swaptotal_mb'] > 0
|
|
|
|
- name: Remove swap from /etc/fstab
|
|
replace:
|
|
path: /etc/fstab
|
|
regexp: '^([^#].*\s+swap\s+.*)$'
|
|
replace: '# \1'
|
|
|
|
# ── Kernel modules ────────────────────────────────────────────────
|
|
- name: Load kernel modules at boot
|
|
copy:
|
|
dest: /etc/modules-load.d/k8s.conf
|
|
content: |
|
|
overlay
|
|
br_netfilter
|
|
|
|
- name: Load kernel modules now
|
|
modprobe:
|
|
name: "{{ item }}"
|
|
loop:
|
|
- overlay
|
|
- br_netfilter
|
|
|
|
# ── sysctl ────────────────────────────────────────────────────────
|
|
- name: Set sysctl for k8s networking
|
|
copy:
|
|
dest: /etc/sysctl.d/k8s.conf
|
|
content: |
|
|
net.bridge.bridge-nf-call-iptables = 1
|
|
net.bridge.bridge-nf-call-ip6tables = 1
|
|
net.ipv4.ip_forward = 1
|
|
|
|
- name: Apply sysctl
|
|
command: sysctl --system
|
|
|
|
# ── NFS client ────────────────────────────────────────────────────
|
|
- name: Install nfs-utils (required for NFS PVC mounts)
|
|
dnf:
|
|
name: nfs-utils
|
|
state: present
|