122 lines
4.3 KiB
YAML
122 lines
4.3 KiB
YAML
---
|
|
- hosts:
|
|
- master
|
|
- worker
|
|
become: true
|
|
gather_facts: true
|
|
any_errors_fatal: true
|
|
pre_tasks:
|
|
- name: Pausing for 5 seconds...
|
|
ansible.builtin.pause:
|
|
seconds: 5
|
|
tasks:
|
|
- name: Locale
|
|
block:
|
|
- name: Locale | Set timezone
|
|
community.general.timezone:
|
|
name: "{{ timezone | default('Etc/UTC') }}"
|
|
- name: Networking
|
|
block:
|
|
- name: Networking | Set hostname to inventory hostname
|
|
ansible.builtin.hostname:
|
|
name: "{{ inventory_hostname }}"
|
|
- name: Networking | Update /etc/hosts to include inventory hostname
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/hosts
|
|
block: |
|
|
127.0.1.1 {{ inventory_hostname }}
|
|
- name: Packages
|
|
block:
|
|
- name: Packages | Improve dnf performance
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/dnf/dnf.conf
|
|
block: |
|
|
defaultyes=True
|
|
deltarpm=True
|
|
install_weak_deps=False
|
|
max_parallel_downloads={{ ansible_processor_vcpus | default('8') }}
|
|
- name: Packages | Import rpmfusion keys
|
|
ansible.builtin.rpm_key:
|
|
state: present
|
|
key: "{{ item }}"
|
|
loop:
|
|
- https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-free-fedora-2020
|
|
- https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020
|
|
- name: Packages | Install required packages
|
|
ansible.builtin.dnf:
|
|
name: "{{ packages | default([]) }}"
|
|
state: present
|
|
update_cache: true
|
|
- name: Packages | Remove leaf packages
|
|
ansible.builtin.dnf:
|
|
autoremove: true
|
|
- name: Packages | Enable automatic downloads of updates
|
|
ansible.builtin.systemd:
|
|
service: dnf-automatic-download.timer
|
|
enabled: true
|
|
state: started
|
|
- name: User Configuration
|
|
block:
|
|
- name: User Configuration | Add additional SSH public keys
|
|
ansible.posix.authorized_key:
|
|
user: "{{ ansible_user }}"
|
|
key: "{{ item }}"
|
|
loop: "{{ public_ssh_keys | default([]) }}"
|
|
- name: System Configuration (1)
|
|
block:
|
|
- name: System Configuration (1) | Disable firewalld
|
|
ansible.builtin.systemd:
|
|
service: firewalld.service
|
|
enabled: false
|
|
masked: true
|
|
state: stopped
|
|
- name: System Configuration (1) | Enable fstrim
|
|
ansible.builtin.systemd:
|
|
service: fstrim.timer
|
|
enabled: true
|
|
- name: System Configuration (2)
|
|
block:
|
|
- name: System Configuration (2) | Enable kernel modules now
|
|
community.general.modprobe:
|
|
name: "{{ item }}"
|
|
state: present
|
|
loop: [br_netfilter, overlay, rbd]
|
|
- name: System Configuration (2) | Enable kernel modules on boot
|
|
ansible.builtin.copy:
|
|
mode: 0644
|
|
content: "{{ item }}"
|
|
dest: "/etc/modules-load.d/{{ item }}.conf"
|
|
loop: [br_netfilter, overlay, rbd]
|
|
- name: System Configuration (2) | Set sysctls
|
|
ansible.posix.sysctl:
|
|
name: "{{ item.key }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
|
|
reload: true
|
|
with_dict: "{{ sysctl_config }}"
|
|
vars:
|
|
sysctl_config:
|
|
net.ipv4.ip_forward: 1
|
|
net.ipv4.conf.all.forwarding: 1
|
|
net.ipv4.conf.all.rp_filter: 0
|
|
net.ipv4.conf.default.rp_filter: 0
|
|
net.ipv6.conf.all.forwarding: 1
|
|
net.bridge.bridge-nf-call-iptables: 1
|
|
net.bridge.bridge-nf-call-ip6tables: 1
|
|
fs.inotify.max_user_watches: 524288
|
|
fs.inotify.max_user_instances: 512
|
|
- name: System Configuration (2) | Disable swap
|
|
ansible.builtin.dnf:
|
|
name: zram-generator-defaults
|
|
state: absent
|
|
- name: System Configuration (2) | Permissive SELinux
|
|
ansible.posix.selinux:
|
|
state: permissive
|
|
policy: targeted
|
|
notify: Reboot
|
|
|
|
handlers:
|
|
- name: Reboot
|
|
ansible.builtin.reboot:
|
|
msg: Rebooting nodes
|