first commit

ansible/README.md

@@ -0,0 +1,17 @@
+# Optional Ansible bootstrap
+
+The playbook applies a small host baseline (AppArmor, unattended security
+updates, swap removal, and SSH hardening) and installs a pinned K3s server. It
+is intentionally separate from the local k3d path so the portfolio can be
+run without cloud credentials.
+
+```bash
+cp inventory.example.yml inventory.yml
+# Replace the Terraform public IP and local SSH key path.
+ansible-playbook -i inventory.yml bootstrap-k3s.yml
+```
+
+Before production use, review the pinned K3s version and extend the playbook
+for your organization’s OS baseline, firewall model, HA topology, and secret
+management. RKE2 can replace K3s here if the target environment requires it.
+

ansible/bootstrap-k3s.yml

@@ -0,0 +1,75 @@
+---
+- name: Harden host and install K3s
+  hosts: k3s_servers
+  become: true
+  gather_facts: true
+
+  vars:
+    k3s_version: "v1.30.6+k3s1"
+    k3s_install_url: "https://get.k3s.io"
+
+  pre_tasks:
+    - name: Require a supported Ubuntu release
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution == "Ubuntu"
+          - ansible_distribution_version is version("22.04", ">=")
+        fail_msg: "This playbook expects Ubuntu 22.04 or newer."
+
+  tasks:
+    - name: Install host security prerequisites
+      ansible.builtin.apt:
+        name:
+          - apparmor
+          - apparmor-utils
+          - curl
+          - ca-certificates
+          - unattended-upgrades
+        state: present
+        update_cache: true
+
+    - name: Ensure unattended security upgrades are enabled
+      ansible.builtin.service:
+        name: unattended-upgrades
+        state: started
+        enabled: true
+
+    - name: Disable swap for Kubernetes node
+      ansible.builtin.command: swapoff -a
+      changed_when: false
+
+    - name: Remove swap entries from fstab
+      ansible.builtin.replace:
+        path: /etc/fstab
+        regexp: '^([^#].*\sswap\s+.*)$'
+        replace: '# Disabled for Kubernetes: \1'
+
+    - name: Set restrictive SSH password authentication
+      ansible.builtin.copy:
+        dest: /etc/ssh/sshd_config.d/60-k8s-baseline.conf
+        owner: root
+        group: root
+        mode: '0644'
+        content: |
+          PasswordAuthentication no
+          PermitRootLogin no
+      notify: Restart ssh
+
+    - name: Install pinned K3s server
+      ansible.builtin.shell: |
+        curl -sfL {{ k3s_install_url }} | INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server --write-kubeconfig-mode 600
+      args:
+        creates: /usr/local/bin/k3s
+
+    - name: Enable and start K3s
+      ansible.builtin.service:
+        name: k3s
+        state: started
+        enabled: true
+
+  handlers:
+    - name: Restart ssh
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+

ansible/inventory.example.yml

@@ -0,0 +1,9 @@
+all:
+  children:
+    k3s_servers:
+      hosts:
+        k3s-1:
+          ansible_host: REPLACE_WITH_TERRAFORM_PUBLIC_IP
+          ansible_user: ubuntu
+          ansible_ssh_private_key_file: ~/.ssh/REPLACE_WITH_KEY
+