* refactor(ansible): replace deprecated with_items and ansible facts
Replace deprecated `with_items` with `loop` keyword across all roles.
Migrate from legacy `ansible_*` top-level facts to `ansible_facts['*']`
syntax to prepare for ansible-core 2.24 where INJECT_FACTS_AS_VARS
will default to False.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
* chore(ansible): sync minimum version requirements to 2.15
Align version checks in prereq and airgap roles with README requirement
of ansible-core 2.15+.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
---------
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Co-authored-by: Claude <noreply@anthropic.com>
* feat(k3s_upgrade): regenerate service files from templates instead of restoring backups
The k3s_upgrade role previously restored backup service files after binary
upgrade, which meant any changes to extra_server_args or extra_agent_args
would not be applied during upgrades.
This change:
- Replaces backup restoration with template-based service file regeneration
- Reuses templates from k3s_server role via symlink
- Adds necessary defaults for template variables
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Changed the condition from checking specific 'ansible_distribution' names to 'ansible_os_family == "RedHat"'. This correctly targets all RHEL-based systems (including AlmaLinux, Rocky, CentOS) and ensures dependencies like 'kernel-modules-extra' are installed without listing each distribution manually.
Signed-off-by: Hanseung Kim <u72mlzb@gmail.com>
* Auto-add --tls-san={{ api_endpoint }} when it differs from ansible_hostname
* Ensures first server generates certificate with all required SANs
* Add .ansible/ and PR_DESCRIPTION.md to gitignore
Signed-off-by: Guillaume Andre <mail@guillaumea.fr>
The condition `when: ansible_all_ipv6_addresses` evaluates to a list, which in
term evaluates to True, but it seems that more recent Ansible versions do not
accept that anymore:
```
Conditional result was "['fe80::...']" of type 'list', which evaluates to True. Conditionals must have a boolean result.
```
This commit adds a length check to create a real Boolean result.
Signed-off-by: Stefan Haun <mail@tuxathome.de>
* Generate token
If a token is not explicitly provided, let the first server generate a
random one. Such a token is saved on the first server and the playbook
can retrieve it from there and store it a a fact. All other servers and
agents can use that token later to join the cluster. It will be saved
into their environment file as usual.
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
* Document that token is (mostly) optional now
The token is still required when using Vagrant.
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
* Check for existing k3s install script during airgap deployment
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Update vagrant file to newer OS
Signed-off-by: Derek Nola <derek.nola@suse.com>
---------
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Prevent multiple tokens in k3s.service.env
If site.yml playbook is executed multiple times with different tokens,
they will all accumulate in k3s.service.env. They won't do any harm
because the last one wins, however it is a matter of good housekeeping
to delete the old before inserting a new one.
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
* Selectively remove existing token from the environment file
If the existing token in the environment file is the same as the token
used for the playbook run, leave it in the file to avoid false changed
status from the task.
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
---------
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
* Security exposure related to the token
The installation playbook saves the token into the systemd unit
configuration file /etc/systemd/system/k3s.service. The problem is that
according to K3s' documentation "the server token should be guarded
carefully" (https://docs.k3s.io/cli/token), yet the configuration file
is readable by anybody. A better solution is to save the token into its
corresponding environment file /etc/systemd/system/k3s.service.env which
is readable by the super user only. This is what the standard K3s'
installation script (https://get.k3s.io) does.
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
* Restore the server URL into systemd configuration file
There aren't any security implications in keeping it there.
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
---------
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
* More flexible cgroup settings
If there are already required cgroup boot parameters present but in a
different order than specified, the script will add them again. It is
better to test for the individual parameter in a loop and selectively
add them as necessary.
Signed-off-by: Marko Vukovic <anonsoftware@gmail.com>
Signed-off-by: Marko Vukovic <anonsoftware@gmail.com>
Signed-off-by: Marko Vukovic <8951449+anon-software@users.noreply.github.com>
