68 lines
1.6 KiB
YAML
68 lines
1.6 KiB
YAML
---
|
|
- name: Require a node address
|
|
ansible.builtin.assert:
|
|
that:
|
|
- k3s_node_ip is defined
|
|
- k3s_node_ip | string | length > 0
|
|
- k3s_node_cidr is defined
|
|
- k3s_node_cidr | string | length > 0
|
|
- k3s_operator_cidrs is defined
|
|
- k3s_operator_cidrs | length > 0
|
|
|
|
- name: Install host dependencies
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- curl
|
|
- firewalld
|
|
- policycoreutils-python-utils
|
|
state: present
|
|
|
|
- name: Enable firewalld
|
|
ansible.builtin.systemd_service:
|
|
name: firewalld
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Trust the k3s pod network
|
|
ansible.posix.firewalld:
|
|
source: "{{ k3s_cluster_cidr }}"
|
|
zone: trusted
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
|
|
- name: Trust the k3s service network
|
|
ansible.posix.firewalld:
|
|
source: "{{ k3s_service_cidr }}"
|
|
zone: trusted
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
|
|
- name: Remove globally open node-to-node k3s ports
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: disabled
|
|
loop:
|
|
- 8472/udp
|
|
- 10250/tcp
|
|
|
|
- name: Allow node-to-node k3s ports from the node network
|
|
ansible.posix.firewalld:
|
|
rich_rule: 'rule family="ipv4" source address="{{ k3s_node_cidr }}" port port="{{ item.port }}" protocol="{{ item.protocol }}" accept'
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop:
|
|
- {port: "8472", protocol: udp}
|
|
- {port: "10250", protocol: tcp}
|
|
|
|
- name: Download the official k3s installer
|
|
ansible.builtin.get_url:
|
|
url: https://get.k3s.io
|
|
dest: /var/tmp/k3s-install.sh
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|