Add Flatcar and Cilium kube-proxy-free architecture

ansible/bootstrap-k3s.yml

@@ -1,5 +1,5 @@
 ---
-- name: Harden host and install K3s
+- name: Configure Flatcar host and install K3s
   hosts: k3s_servers
   become: true
   gather_facts: true
@@ -7,44 +7,22 @@
   vars:
     k3s_version: "v1.30.6+k3s1"
     k3s_install_url: "https://get.k3s.io"
+    k3s_api_server_port: 6443
 
   pre_tasks:
-    - name: Require a supported Ubuntu release
+    - name: Require Flatcar Linux
       ansible.builtin.assert:
         that:
-          - ansible_distribution == "Ubuntu"
-          - ansible_distribution_version is version("22.04", ">=")
-        fail_msg: "This playbook expects Ubuntu 22.04 or newer."
+          - ansible_distribution == "Flatcar"
+        fail_msg: "This playbook expects Flatcar Linux. Use the Ubuntu fallback playbook if needed."
 
   tasks:
-    - name: Install host security prerequisites
-      ansible.builtin.apt:
-        name:
-          - apparmor
-          - apparmor-utils
-          - curl
-          - ca-certificates
-          - unattended-upgrades
-        state: present
-        update_cache: true
-
-    - name: Ensure unattended security upgrades are enabled
-      ansible.builtin.service:
-        name: unattended-upgrades
-        state: started
-        enabled: true
-
-    - name: Disable swap for Kubernetes node
+    - name: Disable swap if a swap device is present
       ansible.builtin.command: swapoff -a
       changed_when: false
+      failed_when: false
 
-    - name: Remove swap entries from fstab
-      ansible.builtin.replace:
-        path: /etc/fstab
-        regexp: '^([^#].*\sswap\s+.*)$'
-        replace: '# Disabled for Kubernetes: \1'
-
-    - name: Set restrictive SSH password authentication
+    - name: Set restrictive SSH authentication
       ansible.builtin.copy:
         dest: /etc/ssh/sshd_config.d/60-k8s-baseline.conf
         owner: root
@@ -53,23 +31,62 @@
         content: |
           PasswordAuthentication no
           PermitRootLogin no
-      notify: Restart ssh
+      notify: Restart sshd
+
+    - name: Create K3s configuration directory
+      ansible.builtin.file:
+        path: /etc/rancher/k3s
+        state: directory
+        owner: root
+        group: root
+        mode: '0750'
+
+    - name: Configure K3s for Cilium kube-proxy replacement
+      ansible.builtin.copy:
+        dest: /etc/rancher/k3s/config.yaml
+        owner: root
+        group: root
+        mode: '0600'
+        content: |
+          write-kubeconfig-mode: "0600"
+          flannel-backend: none
+          disable-network-policy: true
+          disable-kube-proxy: true
+          disable:
+            - traefik
+          https-listen-port: {{ k3s_api_server_port }}
+
+    - name: Download pinned K3s installer
+      ansible.builtin.get_url:
+        url: "{{ k3s_install_url }}"
+        dest: /var/lib/rancher/k3s-install.sh
+        owner: root
+        group: root
+        mode: '0700'
 
     - name: Install pinned K3s server
-      ansible.builtin.shell: |
-        curl -sfL {{ k3s_install_url }} | INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server --write-kubeconfig-mode 600
-      args:
+      ansible.builtin.command:
+        cmd: /var/lib/rancher/k3s-install.sh server
         creates: /usr/local/bin/k3s
+      environment:
+        INSTALL_K3S_VERSION: "{{ k3s_version }}"
 
     - name: Enable and start K3s
-      ansible.builtin.service:
+      ansible.builtin.systemd:
         name: k3s
         state: started
         enabled: true
+        daemon_reload: true
+
+    - name: Wait for K3s API port
+      ansible.builtin.wait_for:
+        host: 127.0.0.1
+        port: "{{ k3s_api_server_port }}"
+        timeout: 120
 
   handlers:
-    - name: Restart ssh
-      ansible.builtin.service:
-        name: ssh
+    - name: Restart sshd
+      ansible.builtin.systemd:
+        name: sshd
         state: restarted