kubernetes/tasks/install/agent/install_k3s.yml

@@ -1,12 +1,13 @@
 - name: Install K3s agent
   command: /root/k3s_install.sh {{ type }}
   register: command
-  changed_when: "'No change detected' not in command.stdout"
+  changed_when: "'No change detected' in command.stdout"
   until: "command is not failed"
   retries: 2
   delay: 10
 
-- name: Make sure service is started / restarted on config change
+- name: Restart when config changed, but install already done
   service:
-    name: k3s-agent
-    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
+    name: k3s
+    status: restarted
+  when: "inventory_hostname != groups['kubernetes'][0] and not command.changed and config.changed"

kubernetes/tasks/install/server/install_k3s.yml

@@ -2,13 +2,13 @@
   command: /root/k3s_install.sh {{ type }}
   when: "inventory_hostname == groups['kubernetes'][0]"
   register: command
-  changed_when: "'No change detected' not in command.stdout"
+  changed_when: "'No change detected' in command.stdout"
 
-- name: Make sure service is started / restarted on config change
+- name: Restart when config changed, but install already done
   service:
     name: k3s
-    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
-  when: "inventory_hostname == groups['kubernetes'][0]"
+    status: restarted
+  when: "inventory_hostname == groups['kubernetes'][0] and not command.changed and config.changed"
 
 - name: Waiting for K3s-server to accept connections
   ansible.builtin.wait_for:
@@ -21,16 +21,16 @@
   command: /root/k3s_install.sh {{ type }}
   when: "inventory_hostname != groups['kubernetes'][0]"
   register: command
-  changed_when: "'No change detected' not in command.stdout"
+  changed_when: "'No change detected' in command.stdout"
   until: "command is not failed"
   retries: 2
   delay: 10
 
-- name: Make sure service is started / restarted on config change
+- name: Restart when config changed, but install already done
   service:
     name: k3s
-    state: "{{ 'restarted' if not command.changed and config.changed else 'started' }}"
-  when: "inventory_hostname != groups['kubernetes'][0]"
+    status: restarted
+  when: "inventory_hostname != groups['kubernetes'][0] and not command.changed and config.changed"
 
 - name: Waiting for K3s-server to accept connections on other nodes
   ansible.builtin.wait_for:

kubernetes/tasks/install/server/network-plugin/deploy_calico.yml

@@ -3,8 +3,6 @@
   register: command
   changed_when: "'created' in command.stdout"
   run_once: true
-  failed_when:
-  - "command.rc == 1 and 'AlreadyExists' not in command.stderr"
 
 - name: Deploy calico ressource template
   ansible.builtin.template:

kubernetes/templates/k3s/agent/config.yaml.jinja2

@@ -1,8 +1,11 @@
-server: https://{{ hostvars[groups['kubernetes'][0]]['nodeip_ipv4'] }}:6443
+server: https://{{ kubernetes.control_plane.dns_name }}:6443
 token: '{{ kubernetes.token }}'
 
 {% if nodeip_ipv6 != "" and kubernetes.ipPool.ipv6 is defined %}
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }} 
+
+# FIXME: Workaround for bug in Kubernetes 1.24/1.25 ignoring node IPv6 addresses
+kubelet-arg: "--node-ip=0.0.0.0"
 {% else %}
 node-ip: {{ nodeip_ipv4 }}
 {% endif %}

kubernetes/templates/k3s/server/config.yaml.jinja2

@@ -15,6 +15,9 @@ tls-san:
 node-ip: {{ nodeip_ipv4 }},{{ nodeip_ipv6 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }},{{ kubernetes.ipPool.ipv6.cluster_cidr }}
 service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }},{{ kubernetes.ipPool.ipv6.service_cidr }}  
+
+# FIXME: Workaround for bug in Kubernetes 1.24/1.25 ignoring node IPv6 addresses
+kubelet-arg: "--node-ip=0.0.0.0"
 {% else %}
 node-ip: {{ nodeip_ipv4 }}
 cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }}
@@ -24,7 +27,7 @@ service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }}
 egress-selector-mode: disabled
 
 # Network-plugin
-{% if kubernetes.network.plugin == "flannel" %}
+{% if kubernetes.network_plugin == "flannel" %}
 flannel-backend: vxlan
 {% else %}
 disable-network-policy: true

nftables/defaults/nftables.yml

@@ -1,29 +0,0 @@
-nftables:
-  # Rules to add
-  #  Handled as templates
-  #  Creates separate files for each entry.
-  # The identifier is necessary for ansible to be able to merge the keys (when 'hash_behaviour = merge')
-  #  rule-ids have to be unique across files and raw
-  rules:
-    # Files with Rules to add
-    files:
-      #'<group_identifier>': '<relative-location>'
-      #'<group_identifier>':
-      #  main: <relative-location>
-      #  '<identifier>': '<relative-location>'
-
-    # Rules to add
-    raw:
-      #'<group_identifier>': '<content>'
-      #'<group_identifier>':
-      #  main: <content>
-      #  '<identifier>': '<content>'
-
-  # Decides if /etc/nftables.conf is applied or separate files which have changed
-  #  Separate changes require the files to be self-tyding to not end up with duplicate rules
-  #  e.g.
-  #   table ip mytable
-  #   flush table ip mytable
-  #   delete table ip mytable
-  #   table ip mytable {} ...
-  apply_global: false

nftables/tasks/apply-files.yml

@@ -1,8 +0,0 @@
-- name: Load group rules
-  command: "nft -f /etc/nftables/ansible-managed/{{ item }}.nft"
-  loop: "{{ combined_rules | list }}"
-  when: not nftables.apply_global
-
-- name: Load global rule file
-  command: "nft -f /etc/nftables.nft"
-  when: nftables.apply_global

nftables/tasks/deploy-rules/main.yml

@@ -1,11 +0,0 @@
-- name: Deploying group files
-  include_tasks: ./per-group-template-file.yml
-  with_items:
-    - "{{ nftables.rules.files | list }}"
-
-- name: Deploying group raw-files
-  include_tasks: ./per-group-template.yml
-  with_items:
-    - "{{ nftables.rules.raw | list }}"
-
-- include_tasks: ./remove-files.yml

nftables/tasks/deploy-rules/per-group-template-file.yml

@@ -1,51 +0,0 @@
-- set_fact:
-    group_identifier: "{{ item }}"
-    value: "{{ nftables.rules.files[item] }}"
-  when: "item is defined"
-
-  #'<group_identifier>': '<relative-location>'
-- block:
-  - name: Create main rule file
-    template:
-      src: "{{ value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-  when: value is string
-
-  #'<group_identifier>':
-  #  main: <relative-location>
-  #  '<identifier>': '<relative-location>'
-- block:
-  - set_fact:
-      items: "{{ nftables.rules.files[item] }}"
-    
-  - block:
-    - name: Create main rule file
-      template:
-        src: "{{ items['main'] }}"
-        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-
-    - name: Include rule files
-      lineinfile:
-        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
-        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
-    when: items['main'] is defined
-
-  - name: Create group folder
-    file:
-      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
-      state: directory
-    when: items|length > 0
-
-  - set_fact:
-      test: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
-
-  - name: Create included rule files
-    template:
-      src: "{{ fileItem.value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ fileItem.key }}.nft"
-    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
-    loop_control:
-      loop_var: fileItem
-
-  when: value is mapping

nftables/tasks/deploy-rules/per-group-template.yml

@@ -1,48 +0,0 @@
-- set_fact:
-    group_identifier: "{{ item }}"
-    value: "{{ nftables.rules.raw[item] }}"
-  when: "item is defined"
-
-  #'<group_identifier>': '<content>'
-- block:
-  - name: Create main rule file
-    copy:
-      content: "{{ value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-  when: value is string
-
-  #'<group_identifier>':
-  #  main: <content>
-  #  '<identifier>': '<content>'
-- block:
-  - set_fact:
-      items: "{{ nftables.rules.raw[item] }}"
-  
-  - block:
-    - name: Create main rule file
-      copy:
-        content: "{{ items['main'] }}"
-        dest: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-
-    - name: Include rule files
-      lineinfile:
-        path: "/etc/nftables/ansible-managed/{{ group_identifier }}.nft"
-        regexp: "include\\s+(\"|')\\/etc\\/nftables\\/ansible-managed\\/{{ group_identifier }}\\/.*$"
-        line: 'include "/etc/nftables/ansible-managed/{{ group_identifier }}/*.nft"'
-    when: items['main'] is defined
-
-  - name: Create group folder
-    file:
-      path: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
-      state: directory
-    when: items|length > 0
-
-  - name: Create included rule files
-    copy:
-      content: "{{ included_item.value }}"
-      dest: "/etc/nftables/ansible-managed/{{ group_identifier }}/{{ included_item.key }}.nft"
-    loop: "{{ items | dict2items | selectattr('key', 'ne', 'main') }}"
-    loop_control:
-      loop_var: included_item
-
-  when: value is mapping

nftables/tasks/install-package.yml

@@ -1,4 +0,0 @@
-- name: Install Packages
-  package:
-    name:
-      - nftables

nftables/tasks/main.yml

@@ -1,7 +0,0 @@
-- import_tasks: ./prerequisites.yml
-
-- import_tasks: ./setup-packages.yml
-
-- import_tasks: ./deploy-rules/main.yml
-
-- import_tasks: ./apply-files.yml

nftables/tasks/prerequisites.yml

@@ -1,13 +0,0 @@
-# Defaults if missing
-- name: Set defaults if missing
-  set_fact:
-    nftables:
-      rules:
-        files: "{{ nftables.rules.files | default({}) | combine({}) }}"
-        raw: "{{ nftables.rules.raw | default({}) | combine({}) }}"
-    combined_rules: "{{ nftables.rules.raw | combine(nftables.rules.files, recursive=true) }}"
-
-#- name: Check items for consistency
-#  assert:
-#    that: "{{ nftables.rules.files.values() | length }} + {{ nftables.rules.raw.values() | length }} == {{ combined_rules.values() | length }}"
-#    fail_msg: "files and raw rules share the same identifier"

nftables/tasks/remove-files.yml

@@ -1,21 +0,0 @@
-- name: Handle removed group files
-  block:
-  - find:
-      paths: /etc/nftables/ansible-managed/
-      file_type: 'any'
-      excludes: '{% for item in combined_rules %}{{ item }},{{ item }}.nft,{% endfor %}'
-      depth: 1
-    register: removeFiles
-
-  - file:
-      path: "{{ fileItem.path }}"
-      state: absent
-    loop: "{{ removeFiles.files }}"
-    loop_control:
-      label: "{{ fileItem.path }}"
-      loop_var: fileItem
-
-- name: Handle removed included files per group
-  include_tasks: ./remove-per-group.yml
-  with_items:
-  - "{{ combined_rules | list }}"

nftables/tasks/remove-per-group.yml

@@ -1,20 +0,0 @@
-- set_fact:
-    group_identifier: "{{ item }}"
-    group_items: "{{ combined_rules[item] }}"
-
-- block:
-  - find:
-      paths: "/etc/nftables/ansible-managed/{{ group_identifier }}/"
-      file_type: 'any'
-      excludes: '{% for item in group_items %}{{ item }}.nft,{% endfor %}'
-    register: removeFiles
-
-  - file:
-      path: "{{ fileItem.path }}"
-      state: absent
-    loop: "{{ removeFiles.files }}"
-    loop_control:
-      label: "{{ fileItem.path }}"
-      loop_var: fileItem
-
-  when: group_items is mapping

nftables/tasks/setup-packages.yml

@@ -1,15 +0,0 @@
-- name: Install nftables
-  package:
-    name:
-      - nftables
-
-- name: Create /etc/nftables/ansible-managed
-  file:
-    path: /etc/nftables/ansible-managed
-    state: directory
-
-- name: Include files in /etc/nftables/ansible-managed/ from /etc/nftables.conf
-  blockinfile:
-    path: /etc/nftables.conf
-    marker: "# {mark} ANSIBLE MANAGED BLOCK - nftables"
-    content: 'include "/etc/nftables/ansible-managed/*.nft"'