Move vars to defaults

common/defaults/main.yml

@@ -1 +0,0 @@
-ipv6_stable_secret: 1111:2222:3333:4444:5555:6666:7777:8888

common/tasks/main.yml

@@ -5,5 +5,3 @@
 - import_tasks: ./packages.yml
 
 - import_tasks: ./aliases.yml
-
-- import_tasks: ./networking.yml

common/tasks/networking.yml

@@ -1,22 +0,0 @@
-- name: Set sysctl settings for ip-forwarding
-  copy:
-      dest: "/etc/sysctl.d/ip-forwarding.conf"
-      content: |
-          net.ipv4.ip_forward           = 1
-          net.ipv6.conf.all.forwarding  = 1
-  notify: reload_sysctl
-
-- name: Set sysctl settings for ipv6-address-generation
-  copy:
-      dest: "/etc/sysctl.d/ipv6-slaac-address-generation.conf"
-      content: |
-          net.ipv6.conf.default.addr_gen_mode = 2
-          net.ipv6.conf.default.stable_secret = {{ ipv6_stable_secret }}
-  notify: reload_sysctl
-
-- name: Set sysctl settings to override ipv6-slaac with enabled forwarding
-  copy:
-      dest: "/etc/sysctl.d/ipv6-slaac-override.conf"
-      content: |
-          net.ipv6.conf.all.accept_ra = 2
-  notify: reload_sysctl

docker/files/docker-compose

@@ -0,0 +1,2 @@
+#!/bin/sh
+docker compose $@

docker/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: restart_docker
+  service:
+      name: "docker"
+      state: restarted

docker/tasks/main.yml

@@ -0,0 +1,40 @@
+#- name: Check if docker is already installed
+#  stat:
+#    path: /usr/bin/docker
+#  register: docker_file
+
+- name: Install Packages
+#  when: docker_file.stat.exists == False
+  package:
+      name:
+          - gpg
+          - gpg-agent
+
+- name: Add docker-key
+  apt_key:
+      url: https://download.docker.com/linux/debian/gpg
+      state: present
+
+- name: Add docker-repository
+  apt_repository:
+      repo: "deb https://download.docker.com/linux/{{ ansible_facts.distribution | lower }} {{ ansible_facts.distribution_release }} stable"
+      state: present
+      filename: docker
+      update_cache: yes
+
+- name: Install docker
+  package:
+      name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-compose-plugin
+          - pass
+      state: latest
+
+- name: Deploy docker-compose command to new docker compose plugin
+  ansible.builtin.copy:
+    src: docker-compose
+    dest: "/usr/local/bin/docker-compose"
+    mode: preserve
+

kubernetes/defaults/main.yml

@@ -0,0 +1,16 @@
+---
+kubernetes:
+  ipPool:
+    ipv4:
+      cluster_cidr: 10.42.0.0/16
+      service_cidr: 10.43.0.0/16
+      nodeip_cidr: 10.41.0.0/24
+    ipv6:
+      cluster_cidr: fd42::/56
+      service_cidr: fd43::/112
+      nodeip_cidr: fd41::/64
+
+  control_plane:
+    dns_name: <control-plane dns-reachable-name>
+
+  shared_token: <shared token for nodes to join>

kubernetes/files/containerd_config.toml

@@ -0,0 +1,35 @@
+#   Copyright 2018-2022 Docker Inc.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+disabled_plugins = []
+
+#root = "/var/lib/containerd"
+#state = "/run/containerd"
+#subreaper = true
+#oom_score = 0
+
+#[grpc]
+#  address = "/run/containerd/containerd.sock"
+#  uid = 0
+#  gid = 0
+
+#[debug]
+#  address = "/run/containerd/debug.sock"
+#  uid = 0
+#  gid = 0
+#  level = "info"
+
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+  [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
+    SystemdCgroup = true

kubernetes/files/helm-manifests/rke2-canal-config.yaml.disabled

@@ -0,0 +1,9 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: rke2-canal
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    flannel:
+      backend: "wireguard"

kubernetes/handlers/main.yml

@@ -0,0 +1,19 @@
+- name: reload_sysctl
+  command: sysctl --system
+
+- name: restart_containerd
+  ansible.builtin.service:
+    name: containerd
+    state: restarted
+
+- name: reload_networking
+  service:
+    name: networking
+    state: restarted
+  async: 5
+  poll: 0
+  notify: wait_for_connection
+
+- name: wait_for_connection
+  wait_for_connection:
+    delay: 5

kubernetes/meta/main.yml

@@ -0,0 +1,4 @@
+---
+  dependencies:
+    - role: docker
+    - role: netmaker

kubernetes/tasks/install_helm.yml

@@ -0,0 +1,17 @@
+- name: Add Balto key
+  apt_key:
+      url: https://baltocdn.com/helm/signing.asc
+      state: present
+
+- name: Add Balto Repository
+  apt_repository:
+      repo: "deb https://baltocdn.com/helm/stable/debian/ all main"
+      state: present
+      filename: kubernetes
+      update_cache: yes
+
+- name: Install helm
+  package:
+      name:
+          - helm
+      state: latest

kubernetes/tasks/install_rke2.yml

@@ -0,0 +1,65 @@
+- name: Create rke-helm-manifests-folder
+  ansible.builtin.file:
+    path: '/var/lib/rancher/rke2/server/manifests/'
+    state: directory
+    mode: '0755'
+
+- name: Deploy helm-manifests
+  ansible.builtin.copy:
+    src: 'helm-manifests/'
+    dest: '/var/lib/rancher/rke2/server/manifests/'
+
+- name: Create rke-folder
+  ansible.builtin.file:
+    path: /etc/rancher/rke2/
+    state: directory
+    mode: '0755'
+
+- name: Deploy rke2 config
+  ansible.builtin.template:
+    src: rke2/config.yaml.template
+    dest: /etc/rancher/rke2/config.yaml
+
+- name: Install RKE2
+  command: bash -c "curl -sfL https://get.rke2.io | sh -"
+
+- name: Add RKE2 environment-vars to /etc/profile.d/
+  blockinfile:
+    path: /etc/profile.d/rke2-bin.sh
+    marker: "# {mark} ANSIBLE MANAGED BLOCK | rke2"
+    block: |
+      export PATH="/var/lib/rancher/rke2/bin/:$PATH"
+      export KUBECONFIG="/etc/rancher/rke2/rke2.yaml"
+    create: true
+
+- name: Enable and start rke2-server service for 1st-node
+  ansible.builtin.service:
+    name: rke2-server
+    enabled: yes
+    state: started
+  when: "inventory_hostname == groups['kubernetes'][0]"
+
+- name: Waiting for kubelet to accept connections
+  ansible.builtin.wait_for:
+    host: "{{ inventory_hostname }}"
+    port: 10250
+    state: started
+  when: "inventory_hostname == groups['kubernetes'][0]"
+
+- name: Enable and start rke2-server service for other nodes
+  ansible.builtin.service:
+    name: rke2-server
+    enabled: yes
+    state: started
+  when: "inventory_hostname != groups['kubernetes'][0]"
+  register: rke2_start
+  until: "rke2_start is not failed"
+  retries: 2
+  delay: 10
+
+- name: Waiting for kubelet to accept connections on other nodes
+  ansible.builtin.wait_for:
+    host: "{{ inventory_hostname }}"
+    port: 10250
+    state: started
+  when: "inventory_hostname != groups['kubernetes'][0]"

kubernetes/tasks/main.yml

@@ -0,0 +1,6 @@
+- import_tasks: ./prerequisites.yml
+
+- import_tasks: ./install_helm.yml
+
+- import_tasks: ./install_rke2.yml
+

kubernetes/tasks/prerequisites.yml

@@ -0,0 +1,89 @@
+#- name: Load br_netfilter kernel-module
+#  modprobe:
+#      name: br_netfilter
+#      state: present
+
+- name: Set sysctl settings for iptables bridged traffic
+  copy:
+    dest: "/etc/sysctl.d/kubernetes.conf"
+    content: |
+        net.bridge.bridge-nf-call-ip6tables = 1
+        net.bridge.bridge-nf-call-iptables = 1
+
+        net.ipv4.conf.all.forwarding=1
+        net.ipv6.conf.all.forwarding=1
+  notify: reload_sysctl
+
+#- name: Disable swap
+#  command: swapoff -a
+
+- name: Install iptables
+  package:
+      name:
+          #- containerd
+          - iptables
+      state: latest
+
+- name: Check if containerd-service exists & is started
+  service:
+    name: containerd
+    state: started
+  ignore_errors: true
+  register: containerd_status
+  
+- name: Install containerd when not exists
+  package:
+    name:
+      - containerd
+  when: containerd_status is failed
+
+- name: Create containerd config-folder
+  file:
+    path: /etc/containerd
+    state: directory
+
+- name: Deploy containerd-config
+  ansible.builtin.copy:
+    src: containerd_config.toml
+    dest: /etc/containerd/config.toml
+    mode: u=rw,g=r,o=r
+  notify: restart_containerd
+
+- name: Set control-plane-dns-endpoint towards local-ip
+  lineinfile:
+    dest: /etc/hosts
+    line: "{{ ansible_facts.default_ipv6.address }} k8s-control-plane.system.ruekov.eu" 
+
+- name: Setting network facts..
+  set_fact:
+    inventory_group_index: "{{ groups['kubernetes'].index(inventory_hostname) }}"
+    ipPool_ipv6_nodeip_cidr_only_prefix:  '{{ kubernetes.ipPool.ipv6.nodeip_cidr | regex_replace ("(?<=:)[0-9a-f]{0,4}(\/[0-9]+)?$","") }}'
+    ipPool_ipv6_nodeip_cidr_cidr:         '{{ kubernetes.ipPool.ipv6.nodeip_cidr | regex_replace ("^.*?\/","") }}'
+    ipPool_ipv4_nodeip_cidr_only_prefix:  '{{ kubernetes.ipPool.ipv4.nodeip_cidr | regex_replace ("(?<=.)[0-9]{0,3}(\/[0-9]+)?$","") }}'
+    ipPool_ipv4_nodeip_cidr_cidr:         '{{ kubernetes.ipPool.ipv4.nodeip_cidr | regex_replace ("^.*?\/","") }}'
+  
+- name: Setting more network_facts..
+  set_fact:
+    ipPool_ipv6_nodeip: "{{ ipPool_ipv6_nodeip_cidr_only_prefix }}{{ inventory_group_index|int +1 }}"
+    ipPool_ipv4_nodeip: "{{ ipPool_ipv4_nodeip_cidr_only_prefix }}{{ inventory_group_index|int +1 }}"
+
+- name: Setup IPv4-Network
+  lineinfile:
+    insertafter: "iface {{ ansible_facts.default_ipv4.interface }} inet .+"
+    dest: "/etc/network/interfaces"
+    line: "    up /usr/sbin/ip addr add {{ ipPool_ipv4_nodeip }} dev {{ ansible_facts.default_ipv4.interface }}"
+  register: setup_network_ipv4
+
+- name: Setup IPv6-Network
+  lineinfile:
+    insertafter: "iface {{ ansible_facts.default_ipv4.interface }} inet6 .+"
+    dest: "/etc/network/interfaces"
+    line: "    up /usr/sbin/ip -6 addr add {{ ipPool_ipv6_nodeip }} dev {{ ansible_facts.default_ipv4.interface }}"
+  register: setup_network_ipv6
+
+- name: Force-Reload network-interface
+  command: "ifup --force {{ ansible_facts.default_ipv4.interface }}"
+  when: setup_network_ipv4.changed or setup_network_ipv6.changed
+
+- name: Run handlers to reload configurations
+  meta: flush_handlers

kubernetes/templates/rke2/config.yaml.template

@@ -0,0 +1,16 @@
+## Base ##
+container-runtime-endpoint: unix:///run/containerd/containerd.sock
+
+{% if inventory_hostname != groups['kubernetes'][0] %}
+server: https://{{ kubernetes.control_plane.dns_name }}:9345
+{% endif %}
+token: {{ kubernetes.shared_token }}
+tls-san:
+  - {{ kubernetes.control_plane.dns_name }}
+
+## Networking ##
+#cni: cilium
+
+cluster-cidr: {{ kubernetes.ipPool.ipv4.cluster_cidr }},{{ kubernetes.ipPool.ipv6.cluster_cidr }}
+service-cidr: {{ kubernetes.ipPool.ipv4.service_cidr }},{{ kubernetes.ipPool.ipv6.service_cidr }}
+node-ip:      {{ ipPool_ipv4_nodeip }},{{ ipPool_ipv6_nodeip }}

zsh/files/.zshrc

@@ -0,0 +1,105 @@
+# If you come from bash you might have to change your $PATH.
+# export PATH=$HOME/bin:/usr/local/bin:$PATH
+
+# Path to your oh-my-zsh installation.
+export ZSH="$HOME/.oh-my-zsh"
+
+# Set name of the theme to load --- if set to "random", it will
+# load a random theme each time oh-my-zsh is loaded, in which case,
+# to know which specific one was loaded, run: echo $RANDOM_THEME
+# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
+ZSH_THEME="agnoster"
+
+# Set list of themes to pick from when loading at random
+# Setting this variable when ZSH_THEME=random will cause zsh to load
+# a theme from this variable instead of looking in $ZSH/themes/
+# If set to an empty array, this variable will have no effect.
+# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
+
+# Uncomment the following line to use case-sensitive completion.
+# CASE_SENSITIVE="true"
+
+# Uncomment the following line to use hyphen-insensitive completion.
+# Case-sensitive completion must be off. _ and - will be interchangeable.
+# HYPHEN_INSENSITIVE="true"
+
+# Uncomment one of the following lines to change the auto-update behavior
+# zstyle ':omz:update' mode disabled  # disable automatic updates
+# zstyle ':omz:update' mode auto      # update automatically without asking
+# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
+
+# Uncomment the following line to change how often to auto-update (in days).
+# zstyle ':omz:update' frequency 13
+
+# Uncomment the following line if pasting URLs and other text is messed up.
+# DISABLE_MAGIC_FUNCTIONS="true"
+
+# Uncomment the following line to disable colors in ls.
+# DISABLE_LS_COLORS="true"
+
+# Uncomment the following line to disable auto-setting terminal title.
+# DISABLE_AUTO_TITLE="true"
+
+# Uncomment the following line to enable command auto-correction.
+# ENABLE_CORRECTION="true"
+
+# Uncomment the following line to display red dots whilst waiting for completion.
+# You can also set it to another string to have that shown instead of the default red dots.
+# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
+# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
+# COMPLETION_WAITING_DOTS="true"
+
+# Uncomment the following line if you want to disable marking untracked files
+# under VCS as dirty. This makes repository status check for large repositories
+# much, much faster.
+# DISABLE_UNTRACKED_FILES_DIRTY="true"
+
+# Uncomment the following line if you want to change the command execution time
+# stamp shown in the history command output.
+# You can set one of the optional three formats:
+# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
+# or set a custom format using the strftime function format specifications,
+# see 'man strftime' for details.
+# HIST_STAMPS="mm/dd/yyyy"
+
+# Would you like to use another custom folder than $ZSH/custom?
+# ZSH_CUSTOM=/path/to/new-custom-folder
+
+# Which plugins would you like to load?
+# Standard plugins can be found in $ZSH/plugins/
+# Custom plugins may be added to $ZSH_CUSTOM/plugins/
+# Example format: plugins=(rails git textmate ruby lighthouse)
+# Add wisely, as too many plugins slow down shell startup.
+plugins=(
+    git
+    zsh-autosuggestions
+    fast-syntax-highlighting
+)
+
+source $ZSH/oh-my-zsh.sh
+
+# User configuration
+
+# export MANPATH="/usr/local/man:$MANPATH"
+
+# You may need to manually set your language environment
+# export LANG=en_US.UTF-8
+
+# Preferred editor for local and remote sessions
+# if [[ -n $SSH_CONNECTION ]]; then
+#   export EDITOR='vim'
+# else
+#   export EDITOR='mvim'
+# fi
+
+# Compilation flags
+# export ARCHFLAGS="-arch x86_64"
+
+# Set personal aliases, overriding those provided by oh-my-zsh libs,
+# plugins, and themes. Aliases can be placed here, though oh-my-zsh
+# users are encouraged to define aliases within the ZSH_CUSTOM folder.
+# For a full list of active aliases, run `alias`.
+#
+# Example aliases
+# alias zshconfig="mate ~/.zshrc"
+# alias ohmyzsh="mate ~/.oh-my-zsh"

zsh/tasks/main.yml

@@ -0,0 +1,44 @@
+- name: Check if user is not root
+  meta: end_play
+  when: ansible_facts.user_id == "root"
+
+- name: Install zsh
+  package:
+    name:
+      - zsh
+    state: latest
+  become: yes
+
+- name: Setup Oh-my-zsh using yay/pacman
+  community.general.pacman:
+    name: 
+      - oh-my-zsh
+      - oh-my-zsh-plugin-autosuggestions
+      - fast-syntax-highlighting
+    state: latest
+    executable: yay
+  when: ansible_facts.distribution == "Archlinux"
+  become: yes
+
+- name: Setup Oh-my-zsh using sh
+  command: 'sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"'
+  when: ansible_facts.distribution != "Archlinux"
+  become: yes
+
+- name: Symlink custom-plugins
+  file:
+    src: "/usr/share/zsh/plugins/fast-syntax-highlighting"
+    dest: "/usr/share/oh-my-zsh/custom/plugins/"
+    state: link
+
+
+- name: Deploy user-config-file
+  ansible.builtin.copy:
+    src: .zshrc
+    dest: "{{ ansible_facts.env.HOME }}/"
+
+- name: Symlink oh-my-zsh user-settings folder from shared
+  file:
+    src: "/usr/share/oh-my-zsh/"
+    dest: "{{ ansible_facts.env.HOME }}/.oh-my-zsh"
+    state: link