Add clean_resolv_conf to the kubernetes role to give k3s a resolv.conf with only the nameserver lines

kubernetes/defaults/main.yml

@@ -19,6 +19,10 @@ kubernetes:
   token: <shared token for nodes to join>
 
   network:
+    # Copies the current /etc/resolv.conf whilst only keeping "nameserver" lines
+    #  can be used to remove filter
+    clean_resolv_conf: false
+
     # One of [flannel, calico]
     plugin: calico
 

kubernetes/tasks/prerequisites.yml

@@ -44,5 +44,17 @@
          if (ansible_facts is defined and ansible_facts.get(interface) is defined and ansible_facts[interface].ipv6 is defined and (ansible_facts[interface].ipv6 | length) > 0)
          else (ansible_default_ipv6.address | default('')) }}
 
+- block:
+    - name: Read resolv.conf
+      shell: "grep '^nameserver' /etc/resolv.conf"
+      register: nameserver_line
+      changed_when: false
+
+    - name: Write /etc/resolv-k3s.conf with only nameservers
+      copy:
+        content: "{{ nameserver_line.stdout }}"
+        dest: /etc/resolv-k3s.conf
+  when: kubernetes.network.clean_resolv_conf is true
+
 - name: Run handlers to reload configurations
   meta: flush_handlers

kubernetes/templates/k3s/agent/config.yaml.jinja2

@@ -1,6 +1,10 @@
 server: https://{{ hostvars[groups['kubernetes'][0]]['nodeip_ipv4'] }}:6443
 token: '{{ kubernetes.token }}'
 
+{% if kubernetes.network.clean_resolv_conf %}
+resolv-conf: /etc/resolv-k3s.conf
+{% endif %}
+
 {% if nodeip_ipv6 != "" and kubernetes.ipPool.ipv6 is defined %}
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }} 
 {% else %}

kubernetes/templates/k3s/server/config.yaml.jinja2

@@ -11,6 +11,10 @@ tls-san:
   - {{ kubernetes.control_plane.dns_name }}
 
 # Networking
+{% if kubernetes.network.clean_resolv_conf %}
+resolv-conf: /etc/resolv-k3s.conf
+{% endif %}
+
 {% if nodeip_ipv6 != "" and kubernetes.ipPool.ipv6 is defined %}
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }},{{ kubernetes.ipPool.ipv6.cluster_cidr }}