36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
---
|
|
- name: Require the runtime cluster token
|
|
ansible.builtin.assert:
|
|
that: lookup('ansible.builtin.env', 'K3S_TOKEN') | length >= 32
|
|
fail_msg: "K3S_TOKEN must contain at least 32 characters."
|
|
no_log: true
|
|
|
|
- name: Remove the globally open k3s API port
|
|
ansible.posix.firewalld:
|
|
port: 6443/tcp
|
|
permanent: true
|
|
immediate: true
|
|
state: disabled
|
|
|
|
- name: Allow the k3s API from node and operator networks
|
|
ansible.posix.firewalld:
|
|
rich_rule: 'rule family="ipv4" source address="{{ item }}" port port="6443" protocol="tcp" accept'
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop: "{{ [k3s_node_cidr] + k3s_operator_cidrs }}"
|
|
|
|
- name: Install or reconcile the k3s server
|
|
ansible.builtin.command: /var/tmp/k3s-install.sh
|
|
environment:
|
|
INSTALL_K3S_VERSION: "{{ k3s_version }}"
|
|
INSTALL_K3S_EXEC: "server --node-ip {{ k3s_node_ip }} --write-kubeconfig-mode 0640"
|
|
K3S_TOKEN: "{{ lookup('ansible.builtin.env', 'K3S_TOKEN') }}"
|
|
changed_when: false
|
|
no_log: true
|
|
|
|
- name: Enable the k3s server
|
|
ansible.builtin.systemd_service:
|
|
name: k3s
|
|
enabled: true
|
|
state: started
|