first commit

2026-08-09 19:52:19 -04:00
commit f12fb4d7a1
25 changed files with 597 additions and 0 deletions
@@ -0,0 +1,75 @@
+---
+- name: Harden host and install K3s
+  hosts: k3s_servers
+  become: true
+  gather_facts: true
+
+  vars:
+    k3s_version: "v1.30.6+k3s1"
+    k3s_install_url: "https://get.k3s.io"
+
+  pre_tasks:
+    - name: Require a supported Ubuntu release
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution == "Ubuntu"
+          - ansible_distribution_version is version("22.04", ">=")
+        fail_msg: "This playbook expects Ubuntu 22.04 or newer."
+
+  tasks:
+    - name: Install host security prerequisites
+      ansible.builtin.apt:
+        name:
+          - apparmor
+          - apparmor-utils
+          - curl
+          - ca-certificates
+          - unattended-upgrades
+        state: present
+        update_cache: true
+
+    - name: Ensure unattended security upgrades are enabled
+      ansible.builtin.service:
+        name: unattended-upgrades
+        state: started
+        enabled: true
+
+    - name: Disable swap for Kubernetes node
+      ansible.builtin.command: swapoff -a
+      changed_when: false
+
+    - name: Remove swap entries from fstab
+      ansible.builtin.replace:
+        path: /etc/fstab
+        regexp: '^([^#].*\sswap\s+.*)$'
+        replace: '# Disabled for Kubernetes: \1'
+
+    - name: Set restrictive SSH password authentication
+      ansible.builtin.copy:
+        dest: /etc/ssh/sshd_config.d/60-k8s-baseline.conf
+        owner: root
+        group: root
+        mode: '0644'
+        content: |
+          PasswordAuthentication no
+          PermitRootLogin no
+      notify: Restart ssh
+
+    - name: Install pinned K3s server
+      ansible.builtin.shell: |
+        curl -sfL {{ k3s_install_url }} | INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server --write-kubeconfig-mode 600
+      args:
+        creates: /usr/local/bin/k3s
+
+    - name: Enable and start K3s
+      ansible.builtin.service:
+        name: k3s
+        state: started
+        enabled: true
+
+  handlers:
+    - name: Restart ssh
+      ansible.builtin.service:
+        name: ssh
+        state: restarted
+