diff --git a/README.md b/README.md index 0adc38fb..6cb82acb 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,7 @@ With that out of the way please continue on if you are still interested... ### 💻 Systems -- One or more nodes with a fresh install of [Fedora Server 37+](https://getfedora.org/en/server/download/) or [Ubuntu 22.04 Server](https://ubuntu.com/download/server) (not minimal). +- One or more nodes with a fresh install of [Ubuntu 22.04 Server](https://ubuntu.com/download/server) (not minimal / not raspi edition). - These nodes can be ARM64/AMD64 bare metal or VMs. - An odd number of control plane nodes, greater than or equal to 3 is required if deploying more than one control plane node. - A [Cloudflare](https://www.cloudflare.com/) account with a domain, this will be managed by external-dns. You can [register new domains](https://www.cloudflare.com/products/registrar/) directly thru Cloudflare. @@ -198,9 +198,9 @@ In order to expose services to the internet you will need to create a [Cloudflar task configure ``` -### ⚡ Preparing Fedora or Ubuntu Server with Ansible +### ⚡ Preparing Ubuntu Server with Ansible -📍 Here we will be running a Ansible Playbook to prepare Fedora or Ubuntu Server for running a Kubernetes cluster. +📍 Here we will be running an Ansible Playbook to prepare Ubuntu server for running a Kubernetes cluster. 📍 Nodes are not security hardened by default, you can do this with [dev-sec/ansible-collection-hardening](https://github.com/dev-sec/ansible-collection-hardening) or similar if supported. This is an advanced configuration and generally not recommended unless you want to [DevSecOps](https://www.ibm.com/topics/devsecops) your cluster and nodes. @@ -226,7 +226,7 @@ In order to expose services to the internet you will need to create a [Cloudflar task ansible:ping ``` -5. Run the Fedora/Ubuntu Server Ansible prepare playbook +5. Run the Ansible prepare playbook ```sh task ansible:prepare diff --git a/ansible/inventory/group_vars/kubernetes/os.yml b/ansible/inventory/group_vars/kubernetes/os.yml index 7494d495..9a5bb19c 100644 --- a/ansible/inventory/group_vars/kubernetes/os.yml +++ b/ansible/inventory/group_vars/kubernetes/os.yml @@ -2,21 +2,6 @@ # ssh_authorized_keys: [] -fedora: - packages: - - dnf-plugin-system-upgrade - - dnf-utils - - hdparm - - htop - - ipvsadm - - lm_sensors - - nano - - nvme-cli - - socat - - python3-kubernetes - - python3-libselinux - - python3-pyyaml - ubuntu: packages: - hdparm diff --git a/ansible/playbooks/cluster-prepare.yml b/ansible/playbooks/cluster-prepare.yml index 8bfd44ce..20b97dc4 100644 --- a/ansible/playbooks/cluster-prepare.yml +++ b/ansible/playbooks/cluster-prepare.yml @@ -21,25 +21,13 @@ - name: Networking | Set hostname to inventory hostname ansible.builtin.hostname: name: "{{ inventory_hostname }}" - - name: Networking | Update /etc/hosts to include inventory hostname + - name: Networking | Update hosts file to include inventory hostname ansible.builtin.blockinfile: path: /etc/hosts block: | 127.0.1.1 {{ inventory_hostname }} - - name: Packages | Fedora - block: - - name: Packages | Install required packages - ansible.builtin.dnf: - name: "{{ fedora.packages | default([]) }}" - state: present - update_cache: true - - name: Packages | Remove leaf packages - ansible.builtin.dnf: - autoremove: true - when: ansible_facts['distribution'] == 'Fedora' - - - name: Packages | Ubuntu + - name: Packages block: - name: Packages | Install required packages ansible.builtin.apt: @@ -55,7 +43,6 @@ install_recommends: false notify: Reboot when: "'raspi' in ansible_kernel" - when: ansible_facts['distribution'] == 'Ubuntu' - name: Packages | Cilium CLI ansible.builtin.include_role: @@ -78,20 +65,12 @@ - name: System Configuration (1) block: - - name: System Configuration (1) | Disable firewalld | Fedora - ansible.builtin.systemd: - service: firewalld.service - enabled: false - masked: true - state: stopped - when: ansible_facts['distribution'] == 'Fedora' - - name: System Configuration (1) | Disable ufw | Ubuntu + - name: System Configuration (1) | Disable ufw ansible.builtin.systemd: service: ufw.service enabled: false masked: true state: stopped - when: ansible_facts['distribution'] == 'Ubuntu' - name: System Configuration (1) | Enable fstrim ansible.builtin.systemd: service: fstrim.timer @@ -128,28 +107,15 @@ net.bridge.bridge-nf-call-ip6tables: 1 fs.inotify.max_user_watches: 524288 fs.inotify.max_user_instances: 512 - - name: System Configuration (2) | Disable swap | Fedora - ansible.builtin.dnf: - name: zram-generator-defaults - state: absent - when: ansible_facts['distribution'] == 'Fedora' - - name: System Configuration (2) | Disable swap at runtime | Ubuntu + - name: System Configuration (2) | Disable swap at runtime ansible.builtin.command: swapoff -a - when: - - ansible_facts['distribution'] == 'Ubuntu' - - ansible_swaptotal_mb > 0 - - name: System Configuration (2) | Disable swap at boot | Ubuntu + when: ansible_swaptotal_mb > 0 + - name: System Configuration (2) | Disable swap at boot ansible.posix.mount: name: "{{ item }}" fstype: swap state: absent loop: ["none", "swap"] - when: ansible_facts['distribution'] == 'Ubuntu' - - name: System Configuration (2) | Permissive SELinux | Fedora - ansible.posix.selinux: - state: permissive - policy: targeted - when: ansible_facts['distribution'] == 'Fedora' notify: Reboot handlers: