From 88159b3875ba059a24712debaef71876410936a2 Mon Sep 17 00:00:00 2001
From: Techno Tim <timothystewart6@gmail.com>
Date: Mon, 3 Aug 2026 09:55:07 -0500
Subject: [PATCH] fix(prereq): install kernel-modules-extra when br_netfilter
 is missing (#684)

- On RHEL 10 / Rocky Linux 10 the default cloud image does not ship the
  kernel-modules-extra that contains br_netfilter, so modprobe br_netfilter
  fails during prereq on RedHat family
- Detect whether the module exists and install kernel-modules-extra when absent
- No reboot is required: the module is installed for the currently running kernel
  and becomes available to modprobe immediately
---
 roles/prereq/tasks/main.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/roles/prereq/tasks/main.yml b/roles/prereq/tasks/main.yml
index 9161f7b1..b5da1ef4 100644
--- a/roles/prereq/tasks/main.yml
+++ b/roles/prereq/tasks/main.yml
@@ -33,6 +33,27 @@
     reload: true
   tags: sysctl
 
+- name: Check if br_netfilter module exists
+  ansible.builtin.shell: |
+    set -o pipefail
+    find /lib/modules/$(uname -r) -name "br_netfilter.ko*" | wc -l
+  args:
+    executable: /bin/bash
+  register: br_netfilter_exists
+  changed_when: false
+  when: ansible_os_family == "RedHat"
+  tags: sysctl
+
+- name: Install kernel-modules-extra if br_netfilter missing
+  ansible.builtin.yum:
+    name: kernel-modules-extra
+    state: present
+    update_cache: true
+  register: kernel_modules_installed
+  when:
+    - ansible_os_family == "RedHat"
+    - br_netfilter_exists.stdout | int == 0
+
 - name: Add br_netfilter to /etc/modules-load.d/
   ansible.builtin.copy:
     content: br_netfilter