76 lines
2.0 KiB
YAML
76 lines
2.0 KiB
YAML
---
|
|
- name: Harden host and install K3s
|
|
hosts: k3s_servers
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
k3s_version: "v1.30.6+k3s1"
|
|
k3s_install_url: "https://get.k3s.io"
|
|
|
|
pre_tasks:
|
|
- name: Require a supported Ubuntu release
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_distribution == "Ubuntu"
|
|
- ansible_distribution_version is version("22.04", ">=")
|
|
fail_msg: "This playbook expects Ubuntu 22.04 or newer."
|
|
|
|
tasks:
|
|
- name: Install host security prerequisites
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apparmor
|
|
- apparmor-utils
|
|
- curl
|
|
- ca-certificates
|
|
- unattended-upgrades
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Ensure unattended security upgrades are enabled
|
|
ansible.builtin.service:
|
|
name: unattended-upgrades
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Disable swap for Kubernetes node
|
|
ansible.builtin.command: swapoff -a
|
|
changed_when: false
|
|
|
|
- name: Remove swap entries from fstab
|
|
ansible.builtin.replace:
|
|
path: /etc/fstab
|
|
regexp: '^([^#].*\sswap\s+.*)$'
|
|
replace: '# Disabled for Kubernetes: \1'
|
|
|
|
- name: Set restrictive SSH password authentication
|
|
ansible.builtin.copy:
|
|
dest: /etc/ssh/sshd_config.d/60-k8s-baseline.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
PasswordAuthentication no
|
|
PermitRootLogin no
|
|
notify: Restart ssh
|
|
|
|
- name: Install pinned K3s server
|
|
ansible.builtin.shell: |
|
|
curl -sfL {{ k3s_install_url }} | INSTALL_K3S_VERSION={{ k3s_version }} sh -s - server --write-kubeconfig-mode 600
|
|
args:
|
|
creates: /usr/local/bin/k3s
|
|
|
|
- name: Enable and start K3s
|
|
ansible.builtin.service:
|
|
name: k3s
|
|
state: started
|
|
enabled: true
|
|
|
|
handlers:
|
|
- name: Restart ssh
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: restarted
|
|
|