README.md

@@ -9,5 +9,3 @@ Deploy kubernetes
 
 https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2?tab=doc
 https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init/
-
-https://github.com/XenitAB/spegel

defaults/main.yml

@@ -2,16 +2,7 @@
 # value for kubernetes_cri: containerd, cri-o
 #kubernetes_cri: "containerd"
 kubernetes_server: false
-kubernetes_interface: '{{ ansible_default_ipv4.interface }}'
 # value for kuberntes_network: flannel, calico, weave-net
 #kubernetes_network: weave-net
 kubernetes_kubeproxy_mode: ipvs
-kubernetes_version: 1.31.5
+kubernetes_version: 1.20.1
-kubernetes_k3s_version: 1.31.5+k3s1
-#kubernetes_pods_network: "10.244.0.0/16"
-#kubernetes_svc_network: "10.96.0.0/12"
-kubernetes_pods_network: "10.42.0.0/16"
-kubernetes_svc_network: "10.43.0.0/16"
-lb_auth_pass: 1be344d62acc46c6858ae8475668a245
-kubernetes_swap_enabled: false
-kubernetes_lvm: true

files/etc/NetworkManager/conf.d/calico.conf

@@ -1,3 +0,0 @@
-# https://docs.tigera.io/calico/latest/operations/troubleshoot/troubleshooting#configure-networkmanager
-[keyfile]
-unmanaged-devices=interface-name:cali*;interface-name:tunl*;interface-name:vxlan.calico;interface-name:wireguard.cali

files/etc/kubernetes/policies/audit-policy.yaml

@@ -10,15 +10,7 @@ rules:
     - group: ""
       # Resource "pods" doesn't match requests to any subresource of pods,
       # which is consistent with the RBAC policy.
-      resources: ["pods", "deployments"]
+      resources: ["pods"]
-
-  - level: RequestResponse
-    resources:
-    - group: "rbac.authorization.k8s.io"
-      # Resource "pods" doesn't match requests to any subresource of pods,
-      # which is consistent with the RBAC policy.
-      resources: ["clusterroles", "clusterrolebindings"]
-
   # Log "pods/log", "pods/status" at Metadata level
   - level: Metadata
     resources:
@@ -56,17 +48,11 @@ rules:
     # The empty string "" can be used to select non-namespaced resources.
     namespaces: ["kube-system"]
 
-  # Log configmap changes in all other namespaces at the RequestResponse level.
+  # Log configmap and secret changes in all other namespaces at the Metadata level.
-  - level: RequestResponse
-    resources:
-    - group: "" # core API group
-      resources: ["configmaps"]
-
-  # Log secret changes in all other namespaces at the Metadata level.
   - level: Metadata
     resources:
     - group: "" # core API group
-      resources: ["secrets"]
+      resources: ["secrets", "configmaps"]
 
   # Log all other resources in core and extensions at the Request level.
   - level: Request

files/etc/kubernetes/psa.yaml

@@ -1,27 +0,0 @@
-apiVersion: apiserver.config.k8s.io/v1
-kind: AdmissionConfiguration
-plugins:
-- name: PodSecurity
-  configuration:
-    apiVersion: pod-security.admission.config.k8s.io/v1beta1
-    kind: PodSecurityConfiguration
-    defaults:
-      enforce: "restricted"
-      enforce-version: "latest"
-      audit: "restricted"
-      audit-version: "latest"
-      warn: "restricted"
-      warn-version: "latest"
-    exemptions:
-      usernames: []
-      runtimeClasses: []
-      namespaces: [kube-system, cis-operator-system]
-- name: EventRateLimit
-  configuration:
-    apiVersion: eventratelimit.admission.k8s.io/v1alpha1
-    kind: Configuration
-    limits:
-    - burst: 20000
-      qps: 5000
-      type: Server
-  path: ""

meta/main.yml

@@ -10,9 +10,7 @@ galaxy_info:
     version:
     - 7
     - 8
-        - 9
   - name: RedHat
     version:
     - 7
     - 8
-        - 9

tasks/Debian.yml

@@ -1,21 +1,21 @@
 ---
-- name: Add docker apt key
+- name: add docker apt key
-  ansible.builtin.apt_key:
+  apt_key:
     url: https://download.docker.com/linux/ubuntu/gpg
     state: present
   when:
     - docker_ver == "docker_ce"
 
-- name: Add docker repository
+- name: add docker repository
-  ansible.builtin.apt_repository:
+  apt_repository:
     repo: 'deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable'
     state: present
-    update_cache: true
+    update_cache: yes
   when:
     - docker_ver == "docker_ce"
 
 - name: "Ensure GRUB_CMDLINE_LINUX is updated"
-  ansible.builtin.lineinfile:
+  lineinfile:
     dest: /etc/default/grub
     regexp: '^(GRUB_CMDLINE_LINUX=".*)"$'
     line: '\1 cgroup_enable=memory swapaccount=1"'
@@ -24,12 +24,12 @@
     - not docker_installed.stat.exists
 
 - name: "Update grub.conf"
-  ansible.builtin.command: update-grub
+  command: update-grub
   when:
     - not docker_installed.stat.exists
 
 - name: "Ensure DEFAULT_FORWARD_POLICY in /etc/default/ufw is updated"
-  ansible.builtin.lineinfile:
+  lineinfile:
     dest: /etc/default/ufw
     regexp: '^(DEFAULT_FORWARD_POLICY=").*"$'
     line: '\1ACCEPT"'

tasks/RedHat.yml

@@ -5,155 +5,55 @@
 #    description: "Kubernetes Repository"
 #    baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-$releasever-x86_64
 #    gpgcheck: yes
-#     enabled: true
+#    enabled: yes
 #    gpgkey: https://packages.cloud.google.com/yum/doc/yum-key.gpg
 #    state: present
 
-# - name: Add Official kubernetes's repo
+- name: Add Official kubernetes's repo
-#   ansible.builtin.template:
+  template:
-#     src: "etc/yum.repos.d/kubernetes.repo.j2"
+    src: "etc/yum.repos.d/kubernetes.repo.j2"
-#     dest: "/etc/yum.repos.d/kubernetes.repo"
+    dest: "/etc/yum.repos.d/kubernetes.repo"
-#     group: root
+    group: root
-#     owner: root
+    owner: root
-#     mode: 0644
+    mode: 0644
-#   when:
-#     - not ansible_machine == "armv7l"
-#     - not ansible_machine == "armv6l"
-#     - kubernetes_cri != "k3s"
-
-- name: Add Official kubernetes's repo on servers
-  ansible.builtin.yum_repository:
-    name: kubernetes
-    description: Kubernetes
-    baseurl: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | regex_replace('^([0-9])\\.([0-9]*).*', '\\1.\\2') }}/rpm/"
-    enabled: true
-    gpgcheck: true
-    repo_gpgcheck: true
-    gpgkey: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | regex_replace('^([0-9])\\.([0-9]*).*', '\\1.\\2') }}/rpm/repodata/repomd.xml.key"
-    exclude: kubelet kubeadm
-  become: true
   when:
     - not ansible_machine == "armv7l"
     - not ansible_machine == "armv6l"
-    - kubernetes_server|bool
     - kubernetes_cri != "k3s"
 
-- name: Add Official kubernetes's repo for Desktop
+- name: Register kubernetes firewalld service
-  ansible.builtin.yum_repository:
+  template:
-    name: kubernetes
+    src: "etc/firewalld/services/kubernetes.xml.j2"
-    description: Kubernetes
+    dest: "/etc/firewalld/services/kubernetes.xml"
-    baseurl: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | regex_replace('^([0-9])\\.([0-9]*).*', '\\1.\\2') }}/rpm/"
+    group: root
-    enabled: true
+    owner: root
-    gpgcheck: true
+    mode: 0644
-    repo_gpgcheck: true
+  register: need_firewalld_reload
-    gpgkey: "https://pkgs.k8s.io/core:/stable:/v{{ kubernetes_version | regex_replace('^([0-9])\\.([0-9]*).*', '\\1.\\2') }}/rpm/repodata/repomd.xml.key"
-    exclude: kubelet kubeadm kubectl
-  become: true
   when:
-    - not ansible_machine == "armv7l"
+    - kubernetes_server|bool
-    - not ansible_machine == "armv6l"
-    - not kubernetes_server|bool
 
-# - name: Redhat | Installing K8s Packages
-#   ansible.builtin.package:
-#     name:
-#       - kubectl
-#       - kubelet
-#       - kubeadm
-#       - iproute-tc
-#       - ipvsadm
-#     state: present
-#     disable_excludes: kubernetes
-#   become: true
-#   register: result
-#   until: result is successful
-
-# - name: Register kubernetes firewalld service
-#   ansible.builtin.template:
-#     src: "etc/firewalld/services/kubernetes.xml.j2"
-#     dest: "/etc/firewalld/services/kubernetes.xml"
-#     group: root
-#     owner: root
-#     mode: 0644
-#   register: need_firewalld_reload
-#   when:
-#     - kubernetes_server|bool
-# 
 #- name: Reload firewalld configuration
-#   ansible.builtin.service:
+#  service:
 #    name: firewalld
 #    state: reloaded
-#     enabled: true
+#    enabled: yes
 #  when:
 #    - kubernetes_server|bool
-#     - need_firewalld_reload is changed
-# 
-##  Définir interface
-# - name: Open Firewalld
-#   ansible.posix.firewalld:
-#     zone: external
-#     service: kubernetes
-#     permanent: true
-#     state: enabled
-#     immediate: true
-#   when:
-##     - need_firewall|bool
-##     - firewall_name == "firewalld"
-#     - kubernetes_server|bool
 
-# - name: Create kubernetes firewalld zone
+- name: reload firewalld to refresh service list
-#   ansible.posix.firewalld:
+  command: firewall-cmd --reload
-#     zone: kubernetes
+  when:
-#     permanent: true
+    - need_firewalld_reload is changed
-#     state: present
+    - kubernetes_server|bool
-#   when:
+
-#     - kubernetes_server|bool
+# Définir interface
-- name: Add kubernetes networks to trusted firewalld zone
+- name: Open Firewalld
-  ansible.posix.firewalld:
+  firewalld:
-#    zone: kubernetes
+    service: kubernetes
-    zone: trusted
     permanent: true
     state: enabled
-    source: "{{ item }}"
+    immediate: true
   when:
+#    - need_firewall|bool
+#    - firewall_name == "firewalld"
     - kubernetes_server|bool
-  with_items:
-    - "{{ kubernetes_pods_network }}"
-    - "{{ kubernetes_svc_network }}"
-
-- name: Add kubernetes networks to trusted firewalld zone
-  ansible.posix.firewalld:
-#    zone: kubernetes
-    zone: trusted
-    permanent: true
-    state: enabled
-    source: "{{ item }}"
-  when:
-    - kubernetes_server|bool
-    - kubernetes_interface is defined
-#    - false
-  with_items:
-    - "{{ (lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.network + '/' + lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.netmask) | ansible.utils.ipaddr('net') }}"
-
-- name: Install kubernetes tools
-  ansible.builtin.dnf:
-    name: "{{ kubernetes_package_name }}"
-    enablerepo: "kubernetes"
-    state: present
-    update_cache: true
-    disable_excludes: kubernetes
-#  notify: Restart kubelet
-  when:
-    - ansible_pkg_mgr == "dnf"
-    - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s")
-
-- name: Install kubernetes tools
-  ansible.builtin.yum:
-    name: "{{ kubernetes_package_name }}"
-    enablerepo: "kubernetes"
-    state: present
-    update_cache: true
-#  notify: Restart kubelet
-  when:
-    - ansible_pkg_mgr == "yum"
-    - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s")

tasks/cluster_k3s.yml

@@ -1,46 +1,19 @@
 ---
 - name: Install Wireguard
-  ansible.builtin.include_role:
+  include_role:
     name: wireguard
-  when:
+#  when:
 #    - kubernetes_cni == "wireguard"
-    - "'Vpn' not in group_names"
-
-- name: Import Rancher key
-  ansible.builtin.rpm_key:
-    state: present
-    key: https://rpm.rancher.io/public.key
-  when:
-    - ansible_os_family == "RedHat"
-
-- name: Install the k3s-selinux rpm from a remote repo for yum distro
-  ansible.builtin.yum:
-    name: "https://github.com/k3s-io/k3s-selinux/releases/download/v1.6.stable.1/k3s-selinux-1.6-1.el7.noarch.rpm"
-    state: present
-  when:
-    - ansible_pkg_mgr == "yum"
-    - ansible_os_family == "RedHat"
-    - ansible_distribution_major_version == '7'
-
-- name: Install the k3s-selinux rpm from a remote repo for dnf distro
-  ansible.builtin.dnf:
-    name: "https://github.com/k3s-io/k3s-selinux/releases/download/v1.6.stable.1/k3s-selinux-1.6-1.el{{ ansible_distribution_major_version }}.noarch.rpm"
-    state: present
-  when:
-    - ansible_pkg_mgr == "dnf"
-    - ansible_os_family == "RedHat"
-    - ansible_distribution_major_version >= '8'
 
 - name: Check if /usr/local/bin/k3s already existe
-  ansible.builtin.stat:
+  stat:
     path: /usr/local/bin/k3s
   register: k3s_bin
-  check_mode: false
   changed_when: False
 
-- name: Retreive k3s binary for x86_64
+- name: retreive k3s binary for x86_64
-  ansible.builtin.get_url:
+  get_url:
-    url: "https://github.com/rancher/k3s/releases/download/v{{ kubernetes_k3s_version | urlencode }}/k3s"
+    url: "https://github.com/rancher/k3s/releases/download/v1.20.2%2Bk3s1/k3s"
     dest: "/usr/local/bin/k3s"
     group: root
     owner: root
@@ -49,9 +22,9 @@
     - not k3s_bin.stat.exists
     - ansible_machine == "x86_64"
 
-- name: Retreive k3s binary for arm64
+- name: retreive k3s binary for arm64
-  ansible.builtin.get_url:
+  get_url:
-    url: "https://github.com/rancher/k3s/releases/download/v{{ kubernetes_k3s_version | urlencode }}/k3s-arm64"
+    url: "https://github.com/rancher/k3s/releases/download/v1.20.2%2Bk3s1/k3s-arm64"
     dest: "/usr/local/bin/k3s"
     group: root
     owner: root
@@ -60,9 +33,9 @@
     - not k3s_bin.stat.exists
     - ansible_machine == "arm64"
 
-- name: Retreive k3s binary for armv6/armv7
+- name: retreive k3s binary for armv6/armv7
-  ansible.builtin.get_url:
+  get_url:
-    url: "https://github.com/rancher/k3s/releases/download/v{{ kubernetes_k3s_version | urlencode }}/k3s-armhf"
+    url: "https://github.com/rancher/k3s/releases/download/v1.20.2%2Bk3s1/k3s-armhf"
     dest: "/usr/local/bin/k3s"
     group: root
     owner: root
@@ -72,7 +45,7 @@
     - (ansible_machine == "armv7l") or (ansible_machine == "armv6l")
 
 - name: Create tools link
-  ansible.builtin.file:
+  file:
     src: "k3s"
     dest: "/usr/local/bin/{{ item }}"
     owner: root
@@ -83,12 +56,23 @@
     - "crictl"
     - "ctr"
 
-- name: Create logical volume for k3s
+# Manque kubernetes_server_token, kubernetes_master url
+
+- name: Deploy systemd service
+  template:
+    src: "etc/systemd/system/{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: 0600
+  with_items:
+    - "k3s.service"
+    - "k3s.service.env"
   when:
-    - kubernetes_lvm|bool
+    - ansible_service_mgr == "systemd"
-  block:
+
 - name: Create thin volumes for k3s
-    community.general.lvol:
+  lvol:
     vg: "{{ item.vg }}"
     lv: "{{ item.name }}"
     thinpool: kubernetes
@@ -96,15 +80,15 @@
   with_items:
     - { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"}
 
-  - name: Create file system on containerd lv
+- name: create file system on containerd lv
-    community.general.filesystem:
+  filesystem:
     fstype: ext4
     dev: "/dev/{{ item.vg }}/{{ item.name }}"
   with_items:
     - { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"}
 
-  - name: Mount logical volumes
+- name: mount logical volumes
-    ansible.posix.mount:
+  mount:
     name: "{{ item.mount_point }}"
     src: "/dev/{{ item.vg }}/{{ item.name }}"
     fstype: ext4
@@ -113,195 +97,8 @@
   with_items:
     - { name: var_lib_k3s, vg: vg_sys, size: 10g, mount_point: /var/lib/rancher/k3s, mount_opts: "discard"}
 
-- name: Ensure protect-kernel-defaults is set
-  ansible.posix.sysctl:
-    name: "{{ item.name }}"
-    value: "{{ item.value }}"
-    sysctl_file: /etc/sysctl.d/90-kubelet.conf
-    reload: true
-  with_items:
-    - { name: "vm.panic_on_oom", value: "0" }
-    - { name: "vm.overcommit_memory", value: "1" }
-    - { name: "kernel.panic", value: "10" }
-    - { name: "kernel.panic_on_oops", value: "1" }
-  when:
-    - kubernetes_server|bool
-
-- name: /etc/kubernetes directory
-  ansible.builtin.file:
-    path: "/etc/kubernetes"
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
-  when:
-    - kubernetes_master|bool
-
-- name: Configure Pod Security
-  ansible.builtin.copy:
-    src: "etc/kubernetes/psa.yaml"
-    dest: "/etc/kubernetes/psa.yaml"
-    group: root
-    owner: root
-    mode: 0644
-  when:
-    - kubernetes_master|bool
-
-- name: Audit policies directory
-  ansible.builtin.file:
-    path: "/etc/kubernetes/policies"
-    state: directory
-    owner: root
-    group: root
-    mode: 0700
-  when:
-    - kubernetes_master|bool
-
-- name: Configure audit policy
-  ansible.builtin.copy:
-    src: "etc/kubernetes/policies/audit-policy.yaml"
-    dest: "/etc/kubernetes/policies/audit-policy.yaml"
-    group: root
-    owner: root
-    mode: 0644
-  when:
-    - kubernetes_master|bool
-
-# Check controlers
-- name: Check if /etc/rancher/k3s/k3s.yaml already existe
-  ansible.builtin.stat:
-    path: /etc/rancher/k3s/k3s.yaml
-  register: st
-  check_mode: false
-  changed_when: False
-  when:
-    - kubernetes_master|bool
-
-- name: Create KubernetesMasterConfigured group
-  ansible.builtin.group_by:
-    key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
-  check_mode: false
-  when:
-    - kubernetes_master|bool
-    - st.stat.exists
-
-# First controler
-- name: Configure first controler
-#  run_once: true
-  block:
-  - name: Create k3s directories on master nodes
-    ansible.builtin.file:
-      path: "{{ item }}"
-      state: directory
-      owner: root
-      group: root
-      mode: 0700
-    with_items:
-      - "/etc/rancher"
-      - "/etc/rancher/k3s"
-      - "/etc/rancher/k3s/config.yaml.d"
-      - "/var/lib/rancher"
-      - "/var/lib/rancher/k3s"
-      - "/var/lib/rancher/k3s/server"
-      - "/var/lib/rancher/k3s/server/manifests"
-    when:
-      - kubernetes_master|bool
-
-  - name: Create k3s directories on all nodes
-    ansible.builtin.file:
-      path: "{{ item }}"
-      state: directory
-      owner: root
-      group: root
-      mode: 0700
-    with_items:
-      - "/var/lib/rancher/k3s/storage"
-
-# semanage fcontext -a -t container_file_t  "/var/lib/rancher/k3s/storage(/.*)?"
-  - name: Allow K3S local-path provisioner to create directories in /var/lib/rancher/k3s/storage
-    community.general.sefcontext:
-      target: '/var/lib/rancher/k3s/storage(/.*)?'
-      setype: container_file_t
-      state: present
-  - name: Apply new SELinux file context to filesystem
-    ansible.builtin.command: restorecon -R  /var/lib/rancher/k3s/storage/
-
-  - name: Deploy Network Policies
-    ansible.builtin.template:
-      src: "{{ item }}.j2"
-      dest: "/{{ item }}"
-      owner: root
-      group: root
-      mode: 0600
-    with_items:
-      - "var/lib/rancher/k3s/server/manifests/np-00-intra-namespace.yaml"
-      - "var/lib/rancher/k3s/server/manifests/np-01-default-network-dns-policy.yaml"
-      - "var/lib/rancher/k3s/server/manifests/np-03-metrics-server-traefik.yaml"
-    when:
-      - kubernetes_master|bool
-
-  - name: Deploy systemd service
-    ansible.builtin.template:
-      src: "{{ item }}.j2"
-      dest: "/{{ item }}"
-      owner: root
-      group: root
-      mode: 0600
-    with_items:
-      - "etc/systemd/system/k3s.service"
-      - "etc/systemd/system/k3s.service.env"
-      - "etc/rancher/k3s/config.yaml"
-    when:
-      - ansible_service_mgr == "systemd"
-
-  - name: Reload systemd
-    ansible.builtin.systemd:
-      daemon_reload: true
-
 - name: Enable k3s on boot
-    ansible.builtin.service:
+  service:
     name: k3s
     state: started
-      enabled: true
+    enabled: yes
-
-  - name: Wait for k3s.yaml
-    wait_for:
-      path: /etc/rancher/k3s/k3s.yaml
-
-  - name: Wait for token
-    wait_for:
-      path: /var/lib/rancher/k3s/server/token
-
-  - name: Add {{ ansible_hostname }} to KubernetesMasterConfigured group
-    ansible.builtin.group_by:
-      key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
-    check_mode: false
-
-  when:
-    - kubernetes_master|bool
-    - vars['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is not defined
-
-# chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt
-
-# Manque kubernetes_server_token, kubernetes_master url
-
-# - name: Deploy systemd service
-#   ansible.builtin.template:
-#     src: "etc/systemd/system/{{ item }}.j2"
-#     dest: "/etc/systemd/system/{{ item }}"
-#     owner: root
-#     group: root
-#     mode: 0600
-#   with_items:
-#     - "k3s.service"
-#     - "k3s.service.env"
-#   when:
-#     - ansible_service_mgr == "systemd"
-
-
-
-- name: Enable k3s on boot
-  ansible.builtin.service:
-    name: k3s
-    state: started
-    enabled: true

tasks/cluster_kubeadm.yml

@@ -1,46 +1,27 @@
 ---
 - name: Install Containerd
-  ansible.builtin.include_role:
+  include_role:
     name: containerd
   when:
     - kubernetes_cri == "containerd"
   #register: kubernetes_cri_changed
 
 - name: Install CRI-O
-  ansible.builtin.include_role:
+  include_role:
     name: cri-o
   when:
     - kubernetes_cri == "cri-o"
   #register: kubernetes_cri_changed
 
 #- name: Restart kubelet after kubernetes cri installation
-#   ansible.builtin.service:
+#  service:
 #    name: kubelet
 #    status: restarted
 #  when:
 #    - kubernetes_cri_changed is changed
 
-- name: Configure NetworkManager for Calico
-  ansible.builtin.copy:
-    src: "etc/NetworkManager/conf.d/calico.conf"
-    dest: "/etc/NetworkManager/conf.d/calico.conf"
-    group: root
-    owner: root
-    mode: 0644
-  when:
-    - kubernetes_network == "calico"
-    - ansible_os_family == "RedHat"
-  register: kubernetes_network_networkmanager_changed
-
-- name: Restart kubelet after kubernetes cri installation
-  ansible.builtin.service:
-    name: NetworkManager
-    status: reload
-  when:
-    - kubernetes_network_networkmanager_changed is changed
-
 - name: Configuring IPVS kernel module to be load on boot
-  ansible.builtin.template:
+  template:
     src: "etc/modules-load.d/ipvs.conf.j2"
     dest: "/etc/modules-load.d/ipvs.conf"
     group: root
@@ -50,7 +31,7 @@
     - kubernetes_kubeproxy_mode == "ipvs"
 
 - name: Load IPVS kernel module for EL7
-  community.general.modprobe:
+  modprobe:
     name: "{{ item }}"
     state: present
   with_items:
@@ -66,7 +47,7 @@
     - ansible_distribution_major_version == '7'
 
 - name: Load IPVS kernel module for EL8
-  community.general.modprobe:
+  modprobe:
     name: "{{ item }}"
     state: present
   with_items:
@@ -78,10 +59,10 @@
   when:
     - kubernetes_kubeproxy_mode == "ipvs"
     - ansible_os_family == "RedHat"
-    - ansible_distribution_major_version >= '8'
+    - ansible_distribution_major_version == '8'
 
 - name: Create thin volumes for kubernetes
-  community.general.lvol:
+  lvol:
     vg: "{{ item.vg }}"
     lv: "{{ item.name }}"
     thinpool: kubernetes
@@ -93,8 +74,8 @@
   when:
     - kubernetes_master|bool
 
-- name: Create file system on containerd lv
+- name: create file system on containerd lv
-  community.general.filesystem:
+  filesystem:
     fstype: ext4
     dev: "/dev/{{ item.vg }}/{{ item.name }}"
   with_items:
@@ -104,8 +85,8 @@
   when:
     - kubernetes_master|bool
 
-- name: Mount logical volumes
+- name: mount logical volumes
-  ansible.posix.mount:
+  mount:
     name: "{{ item.mount_point }}"
     src: "/dev/{{ item.vg }}/{{ item.name }}"
     fstype: ext4
@@ -120,14 +101,14 @@
     - kubernetes_master|bool
 
 - name: Ensuring /var/lib/etcd/lost+found Folder does not exists
-  ansible.builtin.file:
+  file:
     path: "/var/lib/etcd/lost+found"
     state: "absent"
   when:
     - partition_formated is changed
 
 - name: Secure etcd directory
-  ansible.builtin.file:
+  file:
     path: "/var/lib/etcd"
     state: directory
     owner: root
@@ -137,7 +118,7 @@
     - kubernetes_master|bool
 
 - name: Ensuring /etc/systemd/system/kubelet.service.d Folder Exists
-  ansible.builtin.file:
+  file:
     path: "/etc/systemd/system/kubelet.service.d"
     state: "directory"
     group: root
@@ -147,7 +128,7 @@
     - ansible_service_mgr == "systemd"
 
 - name: Configure kubelet service
-  ansible.builtin.template:
+  template:
     src: "etc/{{ item }}.j2"
     dest: "/etc/{{ item }}"
     group: root
@@ -159,35 +140,8 @@
   when:
     - ansible_service_mgr == "systemd"
 
-- name: Configure kubelet service for CRI-O
-  ansible.builtin.template:
-    src: "etc/{{ item }}.j2"
-    dest: "/etc/{{ item }}"
-    group: root
-    owner: root
-    mode: 0644
-  with_items:
-    - "systemd/system/kubelet.service.d/11-cgroups.conf"
-  when:
-    - ansible_service_mgr == "systemd"
-    - kubernetes_cri == "cri-o"
-
-- name: Enable Swap for kubelet service
-  ansible.builtin.template:
-    src: "etc/{{ item }}.j2"
-    dest: "/etc/{{ item }}"
-    group: root
-    owner: root
-    mode: 0644
-  with_items:
-    - "systemd/system/kubelet.service.d/20-allow-swap.conf"
-  when:
-    - ansible_service_mgr == "systemd"
-    - kubernetes_swap_enabled is defined
-    - kubernetes_swap_enabled|bool
-
 - name: Configure kubelet service
-  ansible.builtin.template:
+  template:
     src: "etc/{{ item }}.j2"
     dest: "/etc/{{ item }}"
     group: root
@@ -199,105 +153,79 @@
     - not ansible_service_mgr == "systemd"
 
 - name: Enable kubelet on boot
-  ansible.builtin.service:
+  service:
     name: kubelet
     state: started
-    enabled: true
+    enabled: yes
-
-- name: Audit policies directory
-  ansible.builtin.file:
-    path: "/etc/kubernetes/policies"
-    state: directory
-    owner: root
-    group: root
-    mode: 0700
-  when:
-    - kubernetes_master|bool
-
-# https://v1-17.docs.kubernetes.io/docs/tasks/debug-application-cluster/falco/
-# https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml
-# Ou récupération de ces règles pour une utilisation avec falco
-
-- name: Configure audit policy
-  ansible.builtin.copy:
-    src: "etc/kubernetes/policies/audit-policy.yaml"
-    dest: "/etc/kubernetes/policies/audit-policy.yaml"
-    group: root
-    owner: root
-    mode: 0644
-  when:
-    - kubernetes_master|bool
 
 # First controler
 - name: Check if /etc/kubernetes/admin.conf already existe
-  ansible.builtin.stat:
+  stat:
     path: /etc/kubernetes/admin.conf
   register: st
-  check_mode: false
   changed_when: False
 
 - name: Create KubernetesMasterConfigured group
-  ansible.builtin.group_by:
+  group_by:
-    key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
+    key: KubernetesMasterConfigured
-  check_mode: false
   when:
     - st.stat.exists
 
 - name: Retreive kubeadm Major version
-  ansible.builtin.shell: set -o pipefail && kubeadm version | sed 's/.*{Major:"\([0-9]\)".*/\1/'
+  shell: set -o pipefail && kubeadm version | sed 's/.*{Major:"\([0-9]\)".*/\1/'
   register: kubeadm_version_major
-  check_mode: false
   changed_when: False
 
 - name: Retreive kubeadm Minor version
-  ansible.builtin.shell: set -o pipefail && kubeadm version | sed -e 's/.* Minor:"\([0-9]*\)".*/\1/'
+  shell: set -o pipefail && kubeadm version | sed -e 's/.* Minor:"\([0-9]*\)".*/\1/'
   register: kubeadm_version_minor
-  check_mode: false
   changed_when: False
 
 - name: Defined a default lb_kubemaster
-  ansible.builtin.set_fact:
+  set_fact:
-    lb_kubemaster: "{{ groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] }}"
+    lb_kubemaster: "{{ groups['KubernetesMasters'][0] }}"
   when:
     - lb_kubemaster is undefined
 #    - groups['KubernetesMasters'] | length > 1
   changed_when: False
-  check_mode: false
 
-- name: Deploy First controler
-  block:
 - name: Deploy initial kubeadm config
-      ansible.builtin.template:
+  template:
     src: kubeadm-config.yaml.j2
     dest: /root/kubeadm-config.yaml
     owner: root
     group: root
     mode: 0600
+  when:
+    - groups['KubernetesMasterConfigured'] is not defined
+    - groups['KubernetesMasters'][0] == ansible_hostname
 
-    - name: Init Kubernetes on {{ groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] }}
+- name: Init Kubernetes on {{ groups['KubernetesMasters'][0] }}
-      ansible.builtin.command: kubeadm init --config=/root/kubeadm-config.yaml
+  command: kubeadm init --config=/root/kubeadm-config.yaml
+  when:
+    - groups['KubernetesMasterConfigured'] is not defined
+    - groups['KubernetesMasters'][0] == ansible_hostname
 
 - name: Add {{ ansible_hostname }} to KubernetesMasterConfigured group
-      ansible.builtin.group_by:
+  group_by:
-        key: KubernetesMasterConfigured_{{ kubernetes_cluster_name }}
+    key: KubernetesMasterConfigured
-      check_mode: false
-
   when:
-    - groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is not defined
+    - groups['KubernetesMasterConfigured'] is not defined
-    - groups['KubernetesMasters_' ~ kubernetes_cluster_name][0] == ansible_hostname
+    - groups['KubernetesMasters'][0] == ansible_hostname
 
 # End of first controler
 
 - name: Test if server node already included
-  ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes {{ ansible_hostname | lower }}
+  command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes {{ ansible_hostname | lower }}
   delegate_to: "{{ lb_kubemaster }}"
   register: server_enrolled
   changed_when: False
   ignore_errors: yes
-  check_mode: false
+  when:
+    - groups['KubernetesMasterConfigured'] is not defined
 
 #- name: Deploy kubeadm config
-#   ansible.builtin.template:
+#  template:
 #    src: kubeadm-config.yaml.j2
 #    dest: /root/kubeadm-config.yaml
 #    owner: root
@@ -308,24 +236,24 @@
 #    - server_enrolled.rc == 1
 
 - name: Retreive certificats key on {{ lb_kubemaster }}
-  ansible.builtin.shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | grep -v upload-certs
+  shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | grep -v upload-certs
   register: kubernetes_certificateKey
-  check_mode: false
   delegate_to: "{{ lb_kubemaster }}"
   when:
+    - groups['KubernetesMasterConfigured'] is not defined
     - server_enrolled.rc == 1
     - kubernetes_master|bool
 
 - name: Retreive token on "{{ lb_kubemaster }}"
-  ansible.builtin.command: kubeadm token create
+  command: kubeadm token create
   register: kubetoken
   delegate_to: "{{ lb_kubemaster }}"
-  check_mode: false
   when:
+    - groups['KubernetesMasterConfigured'] is not defined
     - server_enrolled.rc == 1
 
 - name: Retreive hash certificat
-  ansible.builtin.shell: >
+  shell: >
     set -o pipefail &&
     openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt |
     openssl rsa -pubin -outform der 2>/dev/null |
@@ -333,21 +261,23 @@
     sed 's/^.* //'
   register: cacerthash
   delegate_to: "{{ lb_kubemaster }}"
-  check_mode: false
   when:
+    - groups['KubernetesMasterConfigured'] is not defined
     - server_enrolled.rc == 1
 
 - name: Deploy kubeadm config
-  ansible.builtin.template:
+  template:
     src: kubeadm-config.yaml.j2
     dest: /root/kubeadm-config.yaml
     owner: root
     group: root
     mode: 0600
   when:
+    - groups['KubernetesMasterConfigured'] is not defined
     - server_enrolled.rc == 1
 
 - name: Join '{{ ansible_hostname }}' to Kubernetes cluster
-  ansible.builtin.command: kubeadm join --config=/root/kubeadm-config.yaml
+  command: kubeadm join --config=/root/kubeadm-config.yaml
   when:
+    - groups['KubernetesMasterConfigured'] is not defined
     - server_enrolled.rc == 1

tasks/install_server.yml

@@ -1,53 +1,52 @@
 ---
-- name: Include vars for not taint Kubernetes masters
-  ansible.builtin.include_vars: masters.yml
-  when:
-    - kubernetes_master|bool
-    - not kubernetes_master_taint|bool
-
-- name: Add master to KubernetesMasters_ClusterName group
-  ansible.builtin.group_by:
-    key: KubernetesMasters_{{ kubernetes_cluster_name }}
-  check_mode: false
-  when:
-    - "'KubernetesMasters' in group_names"
-
-- name: Add node to KubernetesNodes_ClusterName group
-  ansible.builtin.group_by:
-    key: KubernetesNodes_{{ kubernetes_cluster_name }}
-  check_mode: false
-  when:
-    - "'KubernetesNodes' in group_names"
-
-
 - name: Disable SWAP since kubernetes can't work with swap enabled (1/2)
-  ansible.builtin.command: swapoff -a
+  command: swapoff -a
   changed_when: false
 
 - name: Remove swapfile from /etc/fstab (2/2)
-  ansible.posix.mount:
+  mount:
     name: swap
     fstype: swap
     state: absent
 
 - name: Create a thin pool for kubernetes
-  community.general.lvol:
+  lvol:
     vg: vg_sys
     thinpool: kubernetes
-    size: "{{ lv_kubernetes_size | default('20g') }}"
+    size: 20g
 
-## Install API loadbalancer
+# Install API loadbalancer
-# - ansible.builtin.include_tasks: "load_balancer.yml"
+- include_tasks: "load_balancer.yml"
-#   when:
+  when:
-#     - kubernetes_master|bool
+    - kubernetes_master|bool
-#     - groups['KubernetesMasters'] | length > 1
+    - groups['KubernetesMasters'] | length > 1
+
+- name: Audit policies directory
+  file:
+    path: "/etc/kubernetes/policies"
+    state: directory
+    owner: root
+    group: root
+    mode: 0700
+  when:
+    - kubernetes_master|bool
+
+- name: Configure audit policy
+  copy:
+    src: "etc/kubernetes/policies/audit-policy.yaml"
+    dest: "/etc/kubernetes/policies/audit-policy.yaml"
+    group: root
+    owner: root
+    mode: 0644
+  when:
+    - kubernetes_master|bool
 
 - name: Kubernetes cluster with kubeadm
-  ansible.builtin.include_tasks: "cluster_kubeadm.yml"
+  include_tasks: "cluster_kubeadm.yml"
   when:
     - kubernetes_cri != "k3s"
 - name: Kubernetes cluster with k3s
-  ansible.builtin.include_tasks: "cluster_k3s.yml"
+  include_tasks: "cluster_k3s.yml"
   when:
     - kubernetes_cri == "k3s"
 
@@ -56,7 +55,7 @@
 #
 
 - name: Make /root/.kube directory
-  ansible.builtin.file:
+  file:
     path: "/root/.kube"
     owner: root
     group: root
@@ -66,10 +65,10 @@
     - kubernetes_master|bool
 
 - name: Copy kubeconfig file from /etc/kubernetes/admin.conf
-  ansible.builtin.copy:
+  copy:
     src: "/etc/kubernetes/admin.conf"
     dest: /root/.kube/config
-    remote_src: true
+    remote_src: yes
     owner: root
     group: root
     mode: 0600
@@ -78,10 +77,10 @@
     - kubernetes_cri != "k3s"
 
 - name: Copy kubeconfig file from /etc/rancher/k3s/k3s.yaml
-  ansible.builtin.copy:
+  copy:
     src: "/etc/rancher/k3s/k3s.yaml"
     dest: /root/.kube/config
-    remote_src: true
+    remote_src: yes
     owner: root
     group: root
     mode: 0600
@@ -89,40 +88,27 @@
     - kubernetes_master|bool
     - kubernetes_cri == "k3s"
 
-- name: Make link from /etc/rancher/k3s/k3s.yaml to /etc/kubernetes/admin.conf
-  file:
-    src: "/etc/rancher/k3s/k3s.yaml"
-    state: link
-    dest: "/etc/kubernetes/admin.conf"
-    force: yes
-    owner: root
-    group: root
-  when:
-    - kubernetes_master|bool
-    - kubernetes_cri == "k3s"
-
 #
 # Manque autoconfig de .kube/config local
 #
 
 #- name: Fetching CA certificat 
-#   ansible.builtin.copy:
+#  copy:
 #    src: /etc/kubernetes/pki/ca.crt
 #    dest: /root/.kube/{{ kubernetes_cluster_name }}/ca.crt
 #  when:
 #    - kubernetes_master|bigip_pool
 
-# kubectl get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints --no-headers
 - name: Check if a node is still tainted
-  ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes '{{ ansible_hostname | lower }}' -o jsonpath='{.spec.taints}'
+  command: kubectl --kubeconfig=/etc/kubernetes/admin.conf get nodes '{{ ansible_hostname | lower }}' -o jsonpath='{.spec.taints}'
   register: current_taint
-  check_mode: false
   when:
     - kubernetes_master_taint|bool
 
-- name: Taint the machine if needed
+- name: taint the machine if needed
-#  ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes --all node-role.kubernetes.io/master-
+#  command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes --all node-role.kubernetes.io/master-
-  ansible.builtin.command: kubectl --kubeconfig=/etc/kubernetes/admin.conf taint nodes '{{ ansible_hostname | lower }}' node-role.kubernetes.io/master-
+  command: kubectl taint nodes '{{ ansible_hostname | lower }}' node-role.kubernetes.io/master-
   when:
     - kubernetes_master_taint|bool
     - current_taint.stdout
+

tasks/load_balancer.yml

@@ -1,21 +1,22 @@
 ---
   - name: Install needed packages
-    ansible.builtin.package:
+    package:
-      name:
+      name: "{{ item }}"
+      state: present
+      update_cache: yes
+    with_items:
       - keepalived
       - curl
-      state: present
-      update_cache: true
     notify: Restart keepalived
   - name: Install check_apiserver.sh script for keepalived
-    ansible.builtin.template:
+    template:
       src: etc/keepalived/check_apiserver.sh.j2
       dest: /etc/keepalived/check_apiserver.sh
       owner: root
       group: root
       mode: 0755
   - name: Install keepalived config file
-    ansible.builtin.template:
+    template:
       src: etc/keepalived/keepalived.conf.j2
       dest: /etc/keepalived/keepalived.conf
       owner: root
@@ -27,7 +28,7 @@
       - groups['KubernetesMasters'][0] == ansible_hostname
     notify: Restart keepalived
   - name: Install keepalived config file
-    ansible.builtin.template:
+    template:
       src: etc/keepalived/keepalived.conf.j2
       dest: /etc/keepalived/keepalived.conf
       owner: root
@@ -38,6 +39,3 @@
     when:
       - not groups['KubernetesMasters'][0] == ansible_hostname
     notify: Restart keepalived
-
-  - name: Flush handlers
-    ansible.builtin.meta: flush_handlers

tasks/main.yml

@@ -1,63 +1,55 @@
 ---
-- name: Kubernetes Install
-  tags:
-    - kubernetes
-  block:
 - name: Include vars for {{ ansible_os_family }}
-      ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  include_vars: "{{ ansible_os_family }}.yml"
 
 - name: Define vars for master
-      ansible.builtin.set_fact:
+  set_fact:
     kubernetes_server: true
     kubernetes_master: true
     kubernetes_master_taint: false
-      check_mode: false
   when:
     - "'KubernetesMasters' in group_names"
     - "'KubernetesNodes' not in group_names"
 
 - name: Define vars for node
-      ansible.builtin.set_fact:
+  set_fact:
     kubernetes_server: true
     kubernetes_master: false
     kubernetes_master_taint: false
-      check_mode: false
   when:
     - "'KubernetesNodes' in group_names"
     - "'KubernetesMasters' not in group_names"
 
 - name: Define vars for taint master
-      ansible.builtin.set_fact:
+  set_fact:
     kubernetes_server: true
     kubernetes_master: true
     kubernetes_master_taint: true
-      check_mode: false
   when:
     - "'KubernetesNodes' in group_names"
     - "'KubernetesMasters' in group_names"
 
 - name: Define vars for tooling
-      ansible.builtin.set_fact:
+  set_fact:
     kubernetes_sever: false
-      check_mode: false
   when:
     - "'KubernetesMasters' not in group_names"
     - "'KubernetesNodes' not in group_names"
 
 - name: Install kubernetes rules for {{ ansible_os_family }} OS family
-      ansible.builtin.include_tasks: "{{ ansible_os_family }}.yml"
+  include_tasks: "{{ ansible_os_family }}.yml"
 
-  #   - name: Install kubernetes tools
+- name: Install kubernetes tools
-  #     ansible.builtin.package:
+  package:
-  #       name: "{{ kubernetes_package_name }}"
+    name: "{{ kubernetes_package_name }}"
-  #       state: present
+    state: present
-  #       update_cache: true
+    update_cache: yes
-  ##     notify: Restart kubelet
+#  notify: Restart kubelet
-  #     when:
+  when:
-  #       - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s")
+    - (not kubernetes_server|bool) or ( kubernetes_server|bool and kubernetes_cri != "k3s")
 
 - name: Include kubernetes server rules
-      ansible.builtin.include_tasks: "install_server.yml"
+  include_tasks: "install_server.yml"
   when:
     - kubernetes_server|bool
 

templates/etc/firewalld/services/kubernetes.xml.j2

@@ -9,12 +9,6 @@
 {% if kubernetes_master == true %}
 # Kubernetes API server, used by all
   <port protocol="tcp" port="6443"/>
-{% endif %}
-{% if kubernetes_cri == "k3s" %}
-# K3S with flannel and wireguard
-  <port protocol="udp" port="51820"/>
-{% else %}
-{% if kubernetes_master == true %}
 # etcd server client API, used by kube-apiserver and etcd
   <port protocol="tcp" port="2379"/>
   <port protocol="tcp" port="2380"/>
@@ -24,8 +18,8 @@
   <port protocol="tcp" port="10251"/>
 # kube-controler-manager, used by self
   <port protocol="tcp" port="10252"/>
-# Read-only Kubelet API (Deprecated)
+# ???
-#  <port protocol="tcp" port="10255"/>
+  <port protocol="tcp" port="10255"/>
 {% else %}
   <port protocol="tcp" port="10250"/>
 {% endif %}
@@ -41,5 +35,4 @@
   <port protocol="udp" port="6783-6784"/>
   <port protocol="tcp" port="6783"/>
 {% endif %}
-{% endif %}
 </service>

templates/etc/kubernetes/audit-webhook-kubeconfig.j2

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Config
-clusters:
-- name: falco
-  cluster:
-    server: http://$FALCO_SERVICE_CLUSTERIP:8765/k8s-audit
-contexts:
-- context:
-    cluster: falco
-    user: ""
-  name: default-context
-current-context: default-context
-preferences: {}
-users: []

templates/etc/rancher/k3s/config.yaml.j2

@@ -1,55 +0,0 @@
-{% if 'Vpn' in group_names %}
-flannel-backend: vxlan
-{% else %}
-flannel-backend: wireguard-native
-{% endif %}
-protect-kernel-defaults: true
-{% if kubernetes_master|bool %}
-secrets-encryption: true
-kube-apiserver-arg:
-  - "enable-admission-plugins=NodeRestriction,AlwaysPullImages,EventRateLimit"
-  - 'admission-control-config-file=/etc/kubernetes/psa.yaml'
-  - 'audit-log-path=/var/log/apiserver/audit.log'
-  - 'audit-policy-file=/etc/kubernetes/policies/audit-policy.yaml'
-  - 'audit-log-maxage=30'
-  - 'audit-log-maxbackup=10'
-  - 'audit-log-maxsize=100'
-#  - "request-timeout=300s"
-kube-controller-manager-arg:
-  - 'terminated-pod-gc-threshold=10'
-cluster-cidr:
-  - {{ kubernetes_pods_network }}
-service-cidr:
-  - {{ kubernetes_svc_network }}
-{% if vars['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is not defined %}
-cluster-init: true
-{% else %}
-server: https://{{ kubernetes_master }}:6443
-token: ${NODE_TOKEN}
-{% endif %}
-{% else %}
-server: https://{{ kubernetes_master }}:6443
-token: ${NODE_TOKEN}
-{% endif %}
-kubelet-arg:
-  - 'streaming-connection-idle-timeout=5m'
-  - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
-{% if false %}
-  - 'feature-gates=NodeSwap=true,CloudDualStackNodeIPs=true'
-{% endif %}
-{% if ansible_os_family == "RedHat" %}
-selinux: true
-{% endif %}
-#embedded-registry: true
-disable:
-  - traefik
-{% if lookup('vars', 'ansible_' + kubernetes_interface ) != ansible_host %}
-node-external-ip: {{ ansible_host }}
-{% endif %}
-node-ip: {{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}
-{% if false %}
-# node-external-ip: 1.2.3.4
-#node-label:
-#  - "foo=bar"
-#  - "something=amazing"
-{% endif %}

templates/etc/sysconfig/kubelet.j2

@@ -1,2 +1,2 @@
 #https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#feature-gates
-KUBELET_EXTRA_ARGS="--container-runtime=remote --container-runtime-endpoint={% if kubernetes_cri == "containerd" %}unix:///run/containerd/containerd.sock{% elif kubernetes_cri == "cri-o" %}unix:///var/run/crio/crio.sock{% endif %} --node-ip={{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}"
+KUBELET_EXTRA_ARGS="--container-runtime=remote --container-runtime-endpoint={% if kubernetes_cri == "containerd" %}unix:///run/containerd/containerd.sock{% elif kubernetes_cri == "cri-o" %}unix:///var/run/crio/crio.sock{% endif %} --node-ip={{ ansible_default_ipv4.address }}"

templates/etc/systemd/system/k3s.service.j2

@@ -7,9 +7,9 @@ After=network-online.target
 Type=notify
 EnvironmentFile=/etc/systemd/system/k3s.service.env
 {% if kubernetes_master|bool %}
-ExecStart=/usr/local/bin/k3s server
+ExecStart=/usr/local/bin/k3s server --flannel-backend=wireguard --disable traefik --secrets-encryption
 {% else %}
-ExecStart=/usr/local/bin/k3s agent
+ExecStart=/usr/local/bin/k3s agent --server https://{{ kubernetes_master }}:6443 --token ${NODE_TOKEN}
 {% endif %}
 KillMode=process
 Delegate=yes

templates/etc/systemd/system/kubelet.service.d/0-kubelet-extra-args.conf.j2

@@ -1,2 +1,2 @@
 [Service]
-Environment=KUBELET_EXTRA_ARGS="--container-runtime=remote --container-runtime-endpoint={% if kubernetes_cri == "containerd" %}unix:///run/containerd/containerd.sock{% elif kubernetes_cri == "cri-o" %}unix:///var/run/crio/crio.sock{% endif %} --node-ip={{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}"
+Environment=KUBELET_EXTRA_ARGS="--container-runtime=remote --container-runtime-endpoint={% if kubernetes_cri == "containerd" %}unix:///run/containerd/containerd.sock{% elif kubernetes_cri == "cri-o" %}unix:///var/run/crio/crio.sock{% endif %} --node-ip={{ ansible_default_ipv4.address }}"

templates/etc/systemd/system/kubelet.service.d/11-cgroups.conf.j2

@@ -1,5 +0,0 @@
-# https://stackoverflow.com/a/57456786
-# https://stackoverflow.com/questions/57456667/failed-to-get-kubelets-cgroup
-[Service]
-CPUAccounting=true
-MemoryAccounting=true

templates/etc/systemd/system/kubelet.service.d/20-allow-swap.conf.j2

@@ -1 +0,0 @@
-[Service] Environment="KUBELET_EXTRA_ARGS=--fail-swap-on=false"

templates/etc/yum.repos.d/kubernetes.repo.j2

@@ -1,7 +1,7 @@
 [kubernetes]
 name=Kubernetes
 baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-{{ ansible_machine }}
-enabled=0
+enabled=1
 gpgcheck=1
 repo_gpgcheck=1
 gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg

templates/kubeadm-config.yaml.j2

@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta2
 kind: InitConfiguration
 {% if kubetoken is defined %}
 bootstrapTokens:
@@ -14,9 +14,8 @@ nodeRegistration:
 {% elif  kubernetes_cri == "docker" %}
   criSocket: "/var/run/docker.sock"
 {% endif %}
-  name: {{ ansible_hostname }}
 {% if false %}
-  imagePullPolicy: IfNotPresent
+  name: "ec2-10-100-0-1"
   taints:
   - key: "kubeadmNode"
     value: "master"
@@ -26,47 +25,70 @@ nodeRegistration:
 {% if ansible_service_mgr == "systemd" %}
     cgroup-driver: "systemd"
 {% endif %}
+    container-runtime: "remote"
     runtime-request-timeout: "5m"
-    node-ip: {{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}
+{% if kubernetes_cri == "containerd" %}
+    container-runtime-endpoint: "unix:///run/containerd/containerd.sock"
+{% elif kubernetes_cri == "cri-o" %}
+    container-runtime-endpoint: "unix:///var/run/crio/crio.sock"
+{% endif %}
+    node-ip: {{ ansible_default_ipv4.address }}
     read-only-port: "10255"
   ignorePreflightErrors:
   - SystemVerification
-{% if (kubernetes_master|bool and not kubernetes_master_taint|bool) %}
-  - NumCPU
-{% endif %}
 {% if true == false %}
   - IsPrivilegedUser
 {% endif %}
 localAPIEndpoint:
-  advertiseAddress: "{{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}"
+  advertiseAddress: "{{ ansible_default_ipv4.address }}"
   bindPort: 6443
-{% if kubernetes_master|bool and groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is defined %}
+{% if kubernetes_master|bool and groups['KubernetesMasterConfigured'] is defined %}
 certificateKey: "{{ kubernetes_certificateKey.stdout }}"
 {% endif %}
-{% if kubernetes_master|bool and groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is not defined %}
 ---
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta2
+kind: JoinConfiguration
+{% if kubernetes_master|bool %}
+controlPlane:
+  localAPIEndpoint:
+    advertiseAddress: "{{ ansible_default_ipv4.address }}"
+    bindPort: 6443
+{% if groups['KubernetesMasterConfigured'] is defined %}
+  certificateKey: "{{ kubernetes_certificateKey.stdout }}"
+{% endif %}
+{% endif %}
+discovery:
+  bootstrapToken:
+    apiServerEndpoint: "{{ lb_kubemaster }}:6443"
+{% if groups['KubernetesMasterConfigured'] is defined %}
+    caCertHashes:
+    - sha256:{{ cacerthash.stdout }} 
+    token: "{{ kubetoken.stdout }}"
+{% endif %}
+nodeRegistration:
+  kubeletExtraArgs:
+    node-ip: {{ ansible_default_ipv4.address }}
+    read-only-port: "10255"
+  ignorePreflightErrors:
+  - SystemVerification
+---
+apiVersion: kubeadm.k8s.io/v1beta2
 kind: ClusterConfiguration
 kubernetesVersion: stable
 {% if lbip_kubeapiserver is defined %}
 controlPlaneEndpoint: "{{ lbip_kubeapiserver }}:6443"
 {% else %}
-controlPlaneEndpoint: "{{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}:6443"
+controlPlaneEndpoint: "{{ ansible_default_ipv4.address }}:6443"
 {% endif %}
 apiServer:
   extraArgs:
-    enable-admission-plugins: NodeRestriction,AlwaysPullImages,EventRateLimit
+    enable-admission-plugins: NodeRestriction,PodSecurityPolicy
     authorization-mode: "Node,RBAC"
     audit-policy-file: "/etc/kubernetes/policies/audit-policy.yaml"
     audit-log-path: "/var/log/apiserver/audit.log"
     audit-log-maxage: "30"
     audit-log-maxbackup: "10"
     audit-log-maxsize: "100"
-{% if false %}
-# Falco
-    audit-webhook-config-file: "/etc/kubernetes/policies/audit-webhook-kubeconfig"
-    audit-webhook-batch-max-wait: "5s"
-{% endif %}
   extraVolumes:
   - name: "audit-log"
     hostPath: "/var/log/apiserver"
@@ -74,163 +96,35 @@ apiServer:
     readOnly: false
     pathType: DirectoryOrCreate
   - name: "audit-policies"
-    hostPath: "/etc/kubernetes/policies/audit-policy.yaml"
+    hostPath: "/etc/kubernetes/policies"
-    mountPath: "/etc/kubernetes/policies/audit-policy.yaml"
+    mountPath: "/etc/kubernetes/policies"
     readOnly: false
-    pathType: File
+    pathType: DirectoryOrCreate
 {% if lb_kubemaster is defined %}
   certSANs:
   - "{{ lb_kubemaster }}"
 {% endif %}
 {% if kubernetes_network == "flannel" or kubernetes_network == "calico" %}
 networking:
-  podSubnet: "{{ kubernetes_pods_network }}"
+{% if kubernetes_network == "flannel" %}
-  serviceSubnet: "{{ kubernetes_svc_network }}"
+  podSubnet: "10.244.0.0/16"
-{% endif %}
+{% elif kubernetes_network == "calico" %}
-controllerManager:
+  podSubnet: "192.168.0.0/16"
-  extraArgs:
-    bind-address: 0.0.0.0
-scheduler:
-  extraArgs:
-    bind-address: 0.0.0.0
-etcd:
-  local:
-    dataDir: /var/lib/etcd
-    extraArgs: 
-        listen-metrics-urls: http://0.0.0.0:2381
-{% endif %}
-{% if not kubernetes_master|bool or kubernetes_master|bool and groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is defined %}
----
-apiVersion: kubeadm.k8s.io/v1beta3
-kind: JoinConfiguration
-{% if kubernetes_master|bool %}
-controlPlane:
-  localAPIEndpoint:
-    advertiseAddress: "{{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}"
-    bindPort: 6443
-{% if groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is defined %}
-  certificateKey: "{{ kubernetes_certificateKey.stdout }}"
-{% endif %}
-{% endif %}
-discovery:
-  bootstrapToken:
-    apiServerEndpoint: "{{ lb_kubemaster }}:6443"
-{% if groups['KubernetesMasterConfigured_' ~ kubernetes_cluster_name] is defined %}
-    caCertHashes:
-    - sha256:{{ cacerthash.stdout }} 
-    token: "{{ kubetoken.stdout }}"
-{% endif %}
-nodeRegistration:
-  kubeletExtraArgs:
-    node-ip: {{ lookup('vars', 'ansible_' + kubernetes_interface ).ipv4.address }}
-#    read-only-port: "10255"
-  ignorePreflightErrors:
-  - SystemVerification
-{% if kubernetes_swap_enabled is defined and kubernetes_swap_enabled|bool %}
-  - Swap
-{% endif %}
-{% if (kubernetes_master|bool and not kubernetes_master_taint|bool) %}
-  - NumCPU
 {% endif %}
 {% endif %}
 ---
 apiVersion: kubeproxy.config.k8s.io/v1alpha1
 kind: KubeProxyConfiguration
-metricsBindAddress: "0.0.0.0:10249"
 {% if kubernetes_kubeproxy_mode is defined %}
 mode: {{ kubernetes_kubeproxy_mode }}
-{% if kubernetes_kubeproxy_mode == "ipvs" %}
-ipvs:
-  strictARP: true
-{% endif %}
 {% endif %}
 ---
 apiVersion: kubelet.config.k8s.io/v1beta1
 kind: KubeletConfiguration
-#authentication:
+runtimeRequestTimeout: 5m
-#  anonymous:
-#    enabled: false
-#  webhook:
-#    cacheTTL: 2m0s
-#    enabled: true
-#  x509:
-#    clientCAFile: /etc/kubernetes/pki/ca.crt
-#authorization:
-#  mode: Webhook
-#  webhook:
-#    cacheAuthorizedTTL: 5m0s
-#    cacheUnauthorizedTTL: 30s
 {% if ansible_service_mgr == "systemd" %}
 cgroupDriver: systemd
 {% endif %}
-#cgroupsPerQOS: true
-#clusterDNS:
-#- 10.96.0.10
-#clusterDomain: cluster.local
-#configMapAndSecretChangeDetectionStrategy: Watch
-#containerLogMaxFiles: 5
-#containerLogMaxSize: 10Mi
-#contentType: application/vnd.kubernetes.protobuf
-#cpuCFSQuota: true
-#cpuCFSQuotaPeriod: 100ms
-#cpuManagerPolicy: none
-#cpuManagerReconcilePeriod: 10s
-#enableControllerAttachDetach: true
-#enableDebuggingHandlers: true
-#enforceNodeAllocatable:
-#- pods
-#eventBurst: 10
-#eventRecordQPS: 5
-#evictionHard:
-#  imagefs.available: 15%
-#  memory.available: 500Mi
-#  nodefs.available: 10%
-#  nodefs.inodesFree: 5%
-#evictionPressureTransitionPeriod: 5m0s
-{% if kubernetes_swap_enabled is defined and kubernetes_swap_enabled|bool %}
-# Activation du swap
-failSwapOn: false
-featureGates:
-  NodeSwap: true
-memorySwap:
-  swapBehavior: UnlimitedSwap
-{% endif %}
-#fileCheckFrequency: 20s
-#hairpinMode: promiscuous-bridge
-#healthzBindAddress: 127.0.0.1
-#healthzPort: 10248
-#httpCheckFrequency: 20s
-#imageGCHighThresholdPercent: 85
-#imageGCLowThresholdPercent: 80
-#imageMinimumGCAge: 2m0s
-#iptablesDropBit: 15
-#iptablesMasqueradeBit: 14
-#kubeAPIBurst: 10
-#kubeAPIQPS: 5
-#logging: {}
-#makeIPTablesUtilChains: true
-#maxOpenFiles: 1000000
-#maxPods: 110
-#memorySwap: {}
-#nodeLeaseDurationSeconds: 40
-#nodeStatusReportFrequency: 1m0s
-#nodeStatusUpdateFrequency: 10s
-#oomScoreAdj: -999
-#podPidsLimit: -1
-#port: 10250
-#registryBurst: 10
-#registryPullQPS: 5
-#resolvConf: /etc/resolv.conf
-#rotateCertificates: true
-runtimeRequestTimeout: 5m
-#serializeImagePulls: true
-#shutdownGracePeriod: 0s
-#shutdownGracePeriodCriticalPods: 0s
-#staticPodPath: /etc/kubernetes/manifests
-#streamingConnectionIdleTimeout: 4h0m0s
-#syncFrequency: 1m0s
-#topologyManagerPolicy: none
-#volumeStatsAggPeriod: 1m0s
 
 {% if false %}
 readOnlyPort: 1

templates/var/lib/rancher/k3s/server/manifests/np-00-intra-namespace.yaml.j2

@@ -1,12 +0,0 @@
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: intra-namespace
-  namespace: kube-system
-spec:
-  podSelector: {}
-  ingress:
-    - from:
-      - namespaceSelector:
-          matchLabels:
-            name: kube-system

templates/var/lib/rancher/k3s/server/manifests/np-01-default-network-dns-policy.yaml.j2

@@ -1,17 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-network-dns-policy
-  namespace: kube-system
-spec:
-  ingress:
-  - ports:
-    - port: 53
-      protocol: TCP
-    - port: 53
-      protocol: UDP
-  podSelector:
-    matchLabels:
-      k8s-app: kube-dns
-  policyTypes:
-  - Ingress

templates/var/lib/rancher/k3s/server/manifests/np-03-metrics-server-traefik.yaml.j2

@@ -1,42 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-metrics-server
-  namespace: kube-system
-spec:
-  podSelector:
-    matchLabels:
-      k8s-app: metrics-server
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-svclbtraefik-ingress
-  namespace: kube-system
-spec:
-  podSelector: 
-    matchLabels:
-      svccontroller.k3s.cattle.io/svcname: traefik
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-all-traefik-v121-ingress
-  namespace: kube-system
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: traefik
-  ingress:
-  - {}
-  policyTypes:
-  - Ingress
----

vars/RedHat.yml

@@ -1,9 +1,8 @@
 ---
 kubernetes_package_name: 
-  - kubectl-{{ kubernetes_version }}
+  - kubectl
-  - kubelet-{{ kubernetes_version }}
+  - kubelet
-  - kubeadm-{{ kubernetes_version }}
+  - kubeadm
   - iproute-tc
-  - ipvsadm
 #kubernetes_remove_packages_name:
 #  - kubernetes.io

vars/masters.yml

@@ -1,3 +0,0 @@
----
-lv_containers_size: 2g
-lv_kubernetes_size: 8g