feat(k3s): Updated to v1.26 (#207 )

* feat(k3s): Updated to v1.26.0+k3s2 * feat(k3s): Updated to v1.26.2+k3s1 * feat(k3s): Updated to v1.26.3+k3s1 * feat(k3s): Updated to v1.26.4+k3s1 * feat(k3s): Updated to v1.26.7+k3s1 * feat(k3s): Updated to v1.26.11+k3s2 * feat(k3s): Updated to v1.26.12+k3s1
fix: typos (#416 )
2025-12-25 18:23:05 +01:00 · 2024-01-25 22:09:08 +00:00 · 2024-01-25 20:40:56 +00:00 · 2024-01-25 19:20:02 +00:00 · 2024-01-25 11:34:46 -06:00 · 2024-01-25 09:30:02 -06:00
105 changed files with 2247 additions and 939 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -1,3 +1,20 @@
 ---
 exclude_paths:
  # default paths
  - '.cache/'
  - '.github/'
  - 'test/fixtures/formatting-before/'
  - 'test/fixtures/formatting-prettier/'
  # The "converge" and "reset" playbooks use import_playbook in
  # conjunction with the "env" lookup plugin, which lets the
  # syntax check of ansible-lint fail.
  - 'molecule/**/converge.yml'
  - 'molecule/**/prepare.yml'
  - 'molecule/**/reset.yml'
  # The file was generated by galaxy ansible - don't mess with it.
  - 'galaxy.yml'
 skip_list:
  - 'fqcn-builtins'
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,13 @@
 root = true
 [*]
 indent_style = space
 indent_size = 2
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 end_of_line = lf
 max_line_length = off
 [Makefile]
 indent_style = tab
 [*.go]
 indent_style = tab
--- a/.github/ISSUE_TEMPLATE.md
+++ b/.github/ISSUE_TEMPLATE.md
@@ -26,7 +26,7 @@ Operating system:
 Hardware:
-### Variables Used:
+### Variables Used
 `all.yml`
@@ -52,7 +52,7 @@ metal_lb_controller_tag_version: ""
 metal_lb_ip_range: ""
 ```
-### Hosts 
+### Hosts
 `host.ini`
@@ -73,3 +73,5 @@ node
 ## Possible Solution
 <!--- Not obligatory, but suggest a fix/reason for the bug, -->
 - [ ] I've checked the [General Troubleshooting Guide](https://github.com/techno-tim/k3s-ansible/discussions/20)
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -11,4 +11,5 @@
 - [ ] Ran `site.yml` playbook
 - [ ] Ran `reset.yml` playbook
 - [ ] Did not add any unnecessary changes
 - [ ] Ran pre-commit install at least once before committing
 - [ ] 🚀
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
 ---
 version: 2
 updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    rebase-strategy: "auto"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
--- a/.github/download-boxes.sh
+++ b/.github/download-boxes.sh
@@ -0,0 +1,37 @@
 #!/bin/bash
 # download-boxes.sh
 # Check all molecule.yml files for required Vagrant boxes and download the ones that are not
 # already present on the system.
 set -euo pipefail
 GIT_ROOT=$(git rev-parse --show-toplevel)
 PROVIDER=virtualbox
 # Read all boxes for all platforms from the "molecule.yml" files
 all_boxes=$(cat "${GIT_ROOT}"/molecule/*/molecule.yml |
    yq -r '.platforms[].box' |         # Read the "box" property of each node under "platforms"
    grep --invert-match --regexp=--- | # Filter out file separators
    sort |
    uniq)
 # Read the boxes that are currently present on the system (for the current provider)
 present_boxes=$(
    (vagrant box list |
        grep "${PROVIDER}" | # Filter by boxes available for the current provider
        awk '{print $1;}' |  # The box name is the first word in each line
        sort |
        uniq) ||
        echo "" # In case any of these commands fails, just use an empty list
 )
 # The boxes that we need to download are the ones present in $all_boxes, but not $present_boxes.
 download_boxes=$(comm -2 -3 <(echo "${all_boxes}") <(echo "${present_boxes}"))
 # Actually download the necessary boxes
 if [ -n "${download_boxes}" ]; then
    echo "${download_boxes}" | while IFS= read -r box; do
        vagrant box add --provider "${PROVIDER}" "${box}"
    done
 fi
--- a/.github/workflows/cache.yml
+++ b/.github/workflows/cache.yml
@@ -0,0 +1,42 @@
 ---
 name: "Cache"
 on:
  workflow_call:
 jobs:
  molecule:
    name: cache
    runs-on: self-hosted
    env:
      PYTHON_VERSION: "3.11"
    steps:
      - name: Check out the codebase
        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip' # caching pip dependencies
      - name: Cache Vagrant boxes
        id: cache-vagrant
        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
        with:
          lookup-only: true #if it exists, we don't need to restore and can skip the next step
          path: |
            ~/.vagrant.d/boxes
          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
          restore-keys: |
            vagrant-boxes
      - name: Download Vagrant boxes for all scenarios
        # To save some cache space, all scenarios share the same cache key.
        # On the other hand, this means that the cache contents should be
        # the same across all scenarios. This step ensures that.
        if: steps.cache-vagrant.outputs.cache-hit != 'true' # only run if false since this is just a cache step
        run: |
          ./.github/download-boxes.sh
          vagrant box list
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,18 @@
 ---
 name: "CI"
 on:
  pull_request:
  push:
    branches:
      - master
    paths-ignore:
      - '**/README.md'
 jobs:
  pre:
    uses: ./.github/workflows/cache.yml
  lint:
    uses: ./.github/workflows/lint.yml
    needs: [pre]
  test:
    uses: ./.github/workflows/test.yml
    needs: [pre, lint]
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,31 +1,54 @@
 ---
-name: Lint
+name: Linting
-'on':
+on:
-  pull_request:
+  workflow_call:
  push:
    branches:
      - master
 jobs:
-
+  pre-commit-ci:
-  test:
+    name: Pre-Commit
-    name: Lint
+    runs-on: self-hosted
-    runs-on: ubuntu-latest
+    env:
      PYTHON_VERSION: "3.11"
    steps:
-      - name: Check out the codebase.
+      - name: Check out the codebase
-        uses: actions/checkout@v2
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
      - name: Set up Python 3.7.
        uses: actions/setup-python@v2
        with:
-          python-version: '3.x'
+          ref: ${{ github.event.pull_request.head.sha }}
-      - name: Install test dependencies.
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
-        run: pip3 install yamllint ansible-lint ansible
+        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip' # caching pip dependencies
-      - name: Run yamllint.
+      - name: Restore Ansible cache
-        run: yamllint .
+        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
        with:
          path: ~/.ansible/collections
          key: ansible-${{ hashFiles('collections/requirements.yml') }}
-      - name: Run ansible-lint.
+      - name: Install dependencies
-        run: ansible-lint
+        run: |
          echo "::group::Upgrade pip"
          python3 -m pip install --upgrade pip
          echo "::endgroup::"
          echo "::group::Install Python requirements from requirements.txt"
          python3 -m pip install -r requirements.txt
          echo "::endgroup::"
      - name: Run pre-commit
        uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
  ensure-pinned-actions:
    name: Ensure SHA Pinned Actions
    runs-on: self-hosted
    steps:
      - name: Checkout code
        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
      - name: Ensure SHA pinned actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@af2eb3226618e2494e3d9084f515ad6dcf16e229 # 2.0.1
        with:
          allowlist: |
            aws-actions/
            docker/login-action
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -0,0 +1,76 @@
 ---
 name: Test
 on:
  workflow_call:
 jobs:
  molecule:
    name: Molecule
    runs-on: self-hosted
    strategy:
      matrix:
        scenario:
          - default
          - ipv6
          - single_node
      fail-fast: false
    env:
      PYTHON_VERSION: "3.11"
    steps:
      - name: Check out the codebase
        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Configure VirtualBox
        run: |-
          sudo mkdir -p /etc/vbox
          cat <<EOF | sudo tee -a /etc/vbox/networks.conf > /dev/null
          * 192.168.30.0/24
          * fdad:bad:ba55::/64
          EOF
      - name: Set up Python ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip' # caching pip dependencies
      - name: Restore vagrant Boxes cache
        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
        with:
          path: ~/.vagrant.d/boxes
          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
          fail-on-cache-miss: true
      - name: Install dependencies
        run: |
          echo "::group::Upgrade pip"
          python3 -m pip install --upgrade pip
          echo "::endgroup::"
          echo "::group::Install Python requirements from requirements.txt"
          python3 -m pip install -r requirements.txt
          echo "::endgroup::"
      - name: Test with molecule
        run: molecule test --scenario-name ${{ matrix.scenario }}
        timeout-minutes: 90
        env:
          ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
          ANSIBLE_SSH_RETRIES: 4
          ANSIBLE_TIMEOUT: 120
          PY_COLORS: 1
          ANSIBLE_FORCE_COLOR: 1
      - name: Upload log files
        if: always() # do this even if a step before has failed
        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # 3.1.1
        with:
          name: logs
          path: |
            ${{ runner.temp }}/logs
      - name: Delete old box versions
        if: always() # do this even if a step before has failed
        run: vagrant box prune --force
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
-.vagrant
+.env/
 *.log
 ansible.cfg
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,35 @@
 ---
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: f71fa2c1f9cf5cb705f73dffe4b21f7c61470ba9  # frozen: v4.4.0
    hooks:
      - id: requirements-txt-fixer
      - id: sort-simple-yaml
      - id: detect-private-key
      - id: check-merge-conflict
      - id: end-of-file-fixer
      - id: mixed-line-ending
      - id: trailing-whitespace
        args: [--markdown-linebreak-ext=md]
  - repo: https://github.com/adrienverge/yamllint.git
    rev: b05e028c5881819161d11cb543fd96a30c06cceb  # frozen: v1.32.0
    hooks:
      - id: yamllint
        args: [-c=.yamllint]
  - repo: https://github.com/ansible-community/ansible-lint.git
    rev: 3293b64b939c0de16ef8cb81dd49255e475bf89a  # frozen: v6.17.2
    hooks:
      - id: ansible-lint
  - repo: https://github.com/shellcheck-py/shellcheck-py
    rev: 375289a39f5708101b1f916eb729e8d6da96993f  # frozen: v0.9.0.5
    hooks:
      - id: shellcheck
  - repo: https://github.com/Lucas-C/pre-commit-hooks
    rev: 12885e376b93dc4536ad68d156065601e4433665  # frozen: v1.5.1
    hooks:
      - id: remove-crlf
      - id: remove-tabs
  - repo: https://github.com/sirosen/texthooks
    rev: c4ffd3e31669dd4fa4d31a23436cc13839730084  # frozen: 0.5.0
    hooks:
      - id: fix-smartquotes
--- a/.yamllint
+++ b/.yamllint
@@ -6,4 +6,6 @@ rules:
    max: 120
    level: warning
  truthy:
-    allowed-values: ['true', 'false', 'yes', 'no']
+    allowed-values: ['true', 'false']
 ignore:
  - galaxy.yml
--- a/2
+++ b/2
@@ -174,4 +174,4 @@
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
-   END OF TERMS AND CONDITIONS
+   END OF TERMS AND CONDITIONS
--- a/README.md
+++ b/README.md
@@ -4,21 +4,21 @@
 This playbook will build an HA Kubernetes cluster with `k3s`, `kube-vip` and MetalLB via `ansible`.
-This is based on the work from [this fork](https://github.com/212850a/k3s-ansible) which is based on the work from [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible). It uses [kube-vip](https://kube-vip.chipzoller.dev/) to create a load balancer for control plane, and [metal-lb](https://metallb.universe.tf/installation/) for its service `LoadBalancer`.
+This is based on the work from [this fork](https://github.com/212850a/k3s-ansible) which is based on the work from [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible). It uses [kube-vip](https://kube-vip.io/) to create a load balancer for control plane, and [metal-lb](https://metallb.universe.tf/installation/) for its service `LoadBalancer`.
 If you want more context on how this works, see:
-📄 [Documentation](https://docs.technotim.live/posts/k3s-etcd-ansible/) (including example commands)
+📄 [Documentation](https://technotim.live/posts/k3s-etcd-ansible/) (including example commands)
-📺 [Video](https://www.youtube.com/watch?v=CbkEWcUZ7zM)
+📺 [Watch the Video](https://www.youtube.com/watch?v=CbkEWcUZ7zM)
 ## 📖 k3s Ansible Playbook
 Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
- [X] Debian
+- [x] Debian (tested on version 11)
- [X] Ubuntu
+- [x] Ubuntu (tested on version 22.04)
- [X] CentOS
+- [x] Rocky (tested on version 9)
 on processor architecture:
@@ -28,7 +28,12 @@ on processor architecture:
 ## ✅ System requirements
- Deployment environment must have Ansible 2.4.0+.  If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://docs.technotim.live/posts/ansible-automation/).
+- Control Node (the machine you are running `ansible` commands) must have Ansible 2.11+ If you need a quick primer on Ansible [you can check out my docs and setting up Ansible](https://technotim.live/posts/ansible-automation/).
 - You will also need to install collections that this playbook uses by running `ansible-galaxy collection install -r ./collections/requirements.yml` (important❗)
 - [`netaddr` package](https://pypi.org/project/netaddr/) must be available to Ansible. If you have installed Ansible via apt, this is already taken care of. If you have installed Ansible via `pip`, make sure to install `netaddr` into the respective virtual environment.
 - `server` and `agent` nodes should have passwordless SSH access, if not you can supply arguments to provide credentials `--ask-pass --ask-become-pass` to each command.
 ## 🚀 Getting Started
@@ -62,6 +67,8 @@ node
 If multiple hosts are in the master group, the playbook will automatically set up k3s in [HA mode with etcd](https://rancher.com/docs/k3s/latest/en/installation/ha-embedded/).
 Finally, copy `ansible.example.cfg` to `ansible.cfg` and adapt the inventory path to match the files that you just created.
 This requires at least k3s version `1.19.1` however the version is configurable by using the `k3s_version` variable.
 If needed, you can also edit `inventory/my-cluster/group_vars/all.yml` to match your environment.
@@ -94,24 +101,48 @@ scp debian@master_ip:~/.kube/config ~/.kube/config
 ### 🔨 Testing your cluster
-See the commands [here](https://docs.technotim.live/posts/k3s-etcd-ansible/#testing-your-cluster).
+See the commands [here](https://technotim.live/posts/k3s-etcd-ansible/#testing-your-cluster).
 ### Troubleshooting
 Be sure to see [this post](https://github.com/techno-tim/k3s-ansible/discussions/20) on how to troubleshoot common problems
-### 🔷 Vagrant
+### Testing the playbook using molecule
-You may want to kickstart your k3s cluster by using Vagrant to quickly build you all needed VMs with one command.
+This playbook includes a [molecule](https://molecule.rtfd.io/)-based test setup.
-Head to the `vagrant` subfolder and type `vagrant up` to get your environment setup.
+It is run automatically in CI, but you can also run the tests locally.
-After the VMs have got build, deploy k3s using the Ansible playbook `site.yml` by the
+This might be helpful for quick feedback in a few cases.
-`vagrant provision --provision-with ansible` command.
+You can find more information about it [here](molecule/README.md).
 ### Pre-commit Hooks
 This repo uses `pre-commit` and `pre-commit-hooks` to lint and fix common style and syntax errors.  Be sure to install python packages and then run `pre-commit install`.  For more information, see [pre-commit](https://pre-commit.com/)
 ## 🌌 Ansible Galaxy
 This collection can now be used in larger ansible projects.
 Instructions:
 - create or modify a file `collections/requirements.yml` in your project
 ```yml
 collections:
  - name: ansible.utils
  - name: community.general
  - name: ansible.posix
  - name: kubernetes.core
  - name: https://github.com/techno-tim/k3s-ansible.git
    type: git
    version: master
 ```
 - install via `ansible-galaxy collection install -r ./collections/requirements.yml`
 - every role is now available via the prefix `techno_tim.k3s_ansible.` e.g. `techno_tim.k3s_ansible.lxc`
 ## Thanks 🤝
-This repo is really standing on the shoulders of giants.  To all those who have contributed.
+This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and thanks to these repos for code and ideas:
 Thanks to these repos for code and ideas:
 - [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible)
 - [geerlingguy/turing-pi-cluster](https://github.com/geerlingguy/turing-pi-cluster)
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,12 +0,0 @@
 [defaults]
 nocows = True
 roles_path = ./roles
 inventory  = ./hosts.ini
 remote_tmp = $HOME/.ansible/tmp
 local_tmp  = $HOME/.ansible/tmp
 pipelining = True
 become = True
 host_key_checking = False
 deprecation_warnings = False
 callback_whitelist = profile_tasks
--- a/ansible.example.cfg
+++ b/ansible.example.cfg
@@ -0,0 +1,2 @@
 [defaults]
 inventory = inventory/my-cluster/hosts.ini  ; Adapt this to the path to your inventory file
--- a/collections/requirements.yml
+++ b/collections/requirements.yml
@@ -1,3 +1,6 @@
 ---
 collections:
  - name: ansible.utils
  - name: community.general
  - name: ansible.posix
  - name: kubernetes.core
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
-ansible-playbook site.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook site.yml
--- a/example/service.yml
+++ b/example/service.yml
@@ -4,6 +4,7 @@ kind: Service
 metadata:
  name: nginx
 spec:
  ipFamilyPolicy: PreferDualStack
  selector:
    app: nginx
  ports:
--- a/galaxy.yml
+++ b/galaxy.yml
@@ -0,0 +1,81 @@
 ### REQUIRED
 # The namespace of the collection. This can be a company/brand/organization or product namespace under which all
 # content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
 # underscores or numbers and cannot contain consecutive underscores
 namespace: techno_tim
 # The name of the collection. Has the same character restrictions as 'namespace'
 name: k3s_ansible
 # The version of the collection. Must be compatible with semantic versioning
 version: 1.0.0
 # The path to the Markdown (.md) readme file. This path is relative to the root of the collection
 readme: README.md
 # A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
 # @nicks:irc/im.site#channel'
 authors:
 - your name <example@domain.com>
 ### OPTIONAL but strongly recommended
 # A short summary description of the collection
 description: >
  The easiest way to bootstrap a self-hosted High Availability Kubernetes
  cluster. A fully automated HA k3s etcd install with kube-vip, MetalLB,
  and more.
 # Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
 # accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
 license:
 - Apache-2.0
 # A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
 # requirements as 'namespace' and 'name'
 tags:
  - etcd
  - high-availability
  - k8s
  - k3s
  - k3s-cluster
  - kube-vip
  - kubernetes
  - metallb
  - rancher
 # Collections that this collection requires to be installed for it to be usable. The key of the dict is the
 # collection label 'namespace.name'. The value is a version range
 # L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
 # range specifiers can be set and are separated by ','
 dependencies:
  ansible.utils: '*'
  ansible.posix: '*'
  community.general: '*'
  kubernetes.core: '*'
 # The URL of the originating SCM repository
 repository: https://github.com/techno-tim/k3s-ansible
 # The URL to any online docs
 documentation: https://github.com/techno-tim/k3s-ansible
 # The URL to the homepage of the collection/project
 homepage: https://www.youtube.com/watch?v=CbkEWcUZ7zM
 # The URL to the collection issue tracker
 issues: https://github.com/techno-tim/k3s-ansible/issues
 # A list of file glob-like patterns used to filter any files or directories that should not be included in the build
 # artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This
 # uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry',
 # and '.git' are always filtered. Mutually exclusive with 'manifest'
 build_ignore: []
 # A dict controlling use of manifest directives used in building the collection artifact. The key 'directives' is a
 # list of MANIFEST.in style
 # L(directives,https://packaging.python.org/en/latest/guides/using-manifest-in/#manifest-in-commands). The key
 # 'omit_default_directives' is a boolean that controls whether the default directives are used. Mutually exclusive
 # with 'build_ignore'
 # manifest: null
--- a/inventory/.gitignore
+++ b/inventory/.gitignore
@@ -1,3 +1,3 @@
-*
+/*
 !.gitignore
-!sample/
+!sample/
--- a/inventory/sample/group_vars/all.yml
+++ b/inventory/sample/group_vars/all.yml
@@ -1,5 +1,5 @@
 ---
-k3s_version: v1.23.4+k3s1
+k3s_version: v1.26.12+k3s1
 # this is the user that has ssh access to these machines
 ansible_user: ansibleuser
 systemd_dir: /etc/systemd/system
@@ -17,16 +17,113 @@ apiserver_endpoint: "192.168.30.222"
 # this token should be alpha numeric only
 k3s_token: "some-SUPER-DEDEUPER-secret-password"
-# change these to your liking, the only required one is--no-deploy servicelb
+# The IP on which the node is reachable in the cluster.
-extra_server_args: "--no-deploy servicelb --no-deploy traefik"
+# Here, a sensible default is provided, you can still override
-extra_agent_args: ""
+# it for each of your hosts, though.
 k3s_node_ip: '{{ ansible_facts[flannel_iface]["ipv4"]["address"] }}'
 # Disable the taint manually by setting: k3s_master_taint = false
 k3s_master_taint: "{{ true if groups['node'] | default([]) | length >= 1 else false }}"
 # these arguments are recommended for servers as well as agents:
 extra_args: >-
  --flannel-iface={{ flannel_iface }}
  --node-ip={{ k3s_node_ip }}
 # change these to your liking, the only required are: --disable servicelb, --tls-san {{ apiserver_endpoint }}
 extra_server_args: >-
  {{ extra_args }}
  {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
  --tls-san {{ apiserver_endpoint }}
  --disable servicelb
  --disable traefik
 extra_agent_args: >-
  {{ extra_args }}
 # image tag for kube-vip
-kube_vip_tag_version: "v0.4.4"
+kube_vip_tag_version: "v0.5.12"
 # metallb type frr or native
 metal_lb_type: "native"
 # metallb mode layer2 or bgp
 metal_lb_mode: "layer2"
 # bgp options
 # metal_lb_bgp_my_asn: "64513"
 # metal_lb_bgp_peer_asn: "64512"
 # metal_lb_bgp_peer_address: "192.168.30.1"
 # image tag for metal lb
-metal_lb_speaker_tag_version: "v0.12.1"
+metal_lb_speaker_tag_version: "v0.13.9"
-metal_lb_controller_tag_version: "v0.12.1"
+metal_lb_controller_tag_version: "v0.13.9"
 # metallb ip range for load balancer
 metal_lb_ip_range: "192.168.30.80-192.168.30.90"
 # Only enable if your nodes are proxmox LXC nodes, make sure to configure your proxmox nodes
 # in your hosts.ini file.
 # Please read https://gist.github.com/triangletodd/02f595cd4c0dc9aac5f7763ca2264185 before using this.
 # Most notably, your containers must be privileged, and must not have nesting set to true.
 # Please note this script disables most of the security of lxc containers, with the trade off being that lxc
 # containers are significantly more resource efficient compared to full VMs.
 # Mixing and matching VMs and lxc containers is not supported, ymmv if you want to do this.
 # I would only really recommend using this if you have particularly low powered proxmox nodes where the overhead of
 # VMs would use a significant portion of your available resources.
 proxmox_lxc_configure: false
 # the user that you would use to ssh into the host, for example if you run ssh some-user@my-proxmox-host,
 # set this value to some-user
 proxmox_lxc_ssh_user: root
 # the unique proxmox ids for all of the containers in the cluster, both worker and master nodes
 proxmox_lxc_ct_ids:
  - 200
  - 201
  - 202
  - 203
  - 204
 # Only enable this if you have set up your own container registry to act as a mirror / pull-through cache
 # (harbor / nexus / docker's official registry / etc).
 # Can be beneficial for larger dev/test environments (for example if you're getting rate limited by docker hub),
 # or air-gapped environments where your nodes don't have internet access after the initial setup
 # (which is still needed for downloading the k3s binary and such).
 # k3s's documentation about private registries here: https://docs.k3s.io/installation/private-registry
 custom_registries: false
 # The registries can be authenticated or anonymous, depending on your registry server configuration.
 # If they allow anonymous access, simply remove the following bit from custom_registries_yaml
 #   configs:
 #     "registry.domain.com":
 #       auth:
 #         username: yourusername
 #         password: yourpassword
 # The following is an example that pulls all images used in this playbook through your private registries.
 # It also allows you to pull your own images from your private registry, without having to use imagePullSecrets
 # in your deployments.
 # If all you need is your own images and you don't care about caching the docker/quay/ghcr.io images,
 # you can just remove those from the mirrors: section.
 custom_registries_yaml: |
  mirrors:
    docker.io:
      endpoint:
        - "https://registry.domain.com/v2/dockerhub"
    quay.io:
      endpoint:
        - "https://registry.domain.com/v2/quayio"
    ghcr.io:
      endpoint:
        - "https://registry.domain.com/v2/ghcrio"
    registry.domain.com:
      endpoint:
        - "https://registry.domain.com"
  configs:
    "registry.domain.com":
      auth:
        username: yourusername
        password: yourpassword
 # Only enable and configure these if you access the internet through a proxy
 # proxy_env:
 #   HTTP_PROXY: "http://proxy.domain.local:3128"
 #   HTTPS_PROXY: "http://proxy.domain.local:3128"
 #   NO_PROXY: "*.domain.local,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
--- a/inventory/sample/group_vars/proxmox.yml
+++ b/inventory/sample/group_vars/proxmox.yml
@@ -0,0 +1,2 @@
 ---
 ansible_user: '{{ proxmox_lxc_ssh_user }}'
--- a/inventory/sample/hosts.ini
+++ b/inventory/sample/hosts.ini
@@ -7,6 +7,11 @@
 192.168.30.41
 192.168.30.42
 # only required if proxmox_lxc_configure: true
 # must contain all proxmox instances that have a master or worker node
 # [proxmox]
 # 192.168.30.43
 [k3s_cluster:children]
 master
 node
--- a/molecule/README.md
+++ b/molecule/README.md
@@ -0,0 +1,73 @@
 # Test suites for `k3s-ansible`
 This folder contains the [molecule](https://molecule.rtfd.io/)-based test setup for this playbook.
 ## Scenarios
 We have these scenarios:
 - **default**:
  A 3 control + 2 worker node cluster based very closely on the [sample inventory](../inventory/sample/).
 - **ipv6**:
  A cluster that is externally accessible via IPv6 ([more information](ipv6/README.md))
  To save a bit of test time, this cluster is _not_ highly available, it consists of only one control and one worker node.
 - **single_node**:
  Very similar to the default scenario, but uses only a single node for all cluster functionality.
 ## How to execute
 To test on your local machine, follow these steps:
 ### System requirements
 Make sure that the following software packages are available on your system:
 - [Python 3](https://www.python.org/downloads)
 - [Vagrant](https://www.vagrantup.com/downloads)
 - [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
 ### Set up VirtualBox networking on Linux and macOS
 _You can safely skip this if you are working on Windows._
 Furthermore, the test cluster uses the `192.168.30.0/24` subnet which is [not set up by VirtualBox automatically](https://www.virtualbox.org/manual/ch06.html#network_hostonly).
 To set the subnet up for use with VirtualBox, please make sure that `/etc/vbox/networks.conf` exists and that it contains this line:
 ```
 * 192.168.30.0/24
 * fdad:bad:ba55::/64
 ```
 ### Install Python dependencies
 You will get [Molecule, Ansible and a few extra dependencies](../requirements.txt) via [pip](https://pip.pypa.io/).
 Usually, it is advisable to work in a [virtual environment](https://docs.python.org/3/tutorial/venv.html) for this:
 ```bash
 cd /path/to/k3s-ansible
 # Create a virtualenv at ".env". You only need to do this once.
 python3 -m venv .env
 # Activate the virtualenv for your current shell session.
 # If you start a new session, you will have to repeat this.
 source .env/bin/activate
 # Install the required packages into the virtualenv.
 # These remain installed across shell sessions.
 python3 -m pip install -r requirements.txt
 ```
 ### Run molecule
 With the virtual environment from the previous step active in your shell session, you can now use molecule to test the playbook.
 Interesting commands are:
 - `molecule create`: Create virtual machines for the test cluster nodes.
 - `molecule destroy`: Delete the virtual machines for the test cluster nodes.
 - `molecule converge`: Run the `site` playbook on the nodes of the test cluster.
 - `molecule side_effect`: Run the `reset` playbook on the nodes of the test cluster.
 - `molecule verify`: Verify that the cluster works correctly.
 - `molecule test`: The "all-in-one" sequence of steps that is executed in CI.
  This includes the `create`, `converge`, `verify`, `side_effect` and `destroy` steps.
  See [`molecule.yml`](default/molecule.yml) for more details.
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -0,0 +1,100 @@
 ---
 dependency:
  name: galaxy
 driver:
  name: vagrant
 platforms:
  - name: control1
    box: generic/ubuntu2204
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: 192.168.30.38
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
  - name: control2
    box: generic/debian11
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: 192.168.30.39
  - name: control3
    box: generic/rocky9
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: 192.168.30.40
  - name: node1
    box: generic/ubuntu2204
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - node
    interfaces:
      - network_name: private_network
        ip: 192.168.30.41
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
  - name: node2
    box: generic/rocky9
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - node
    interfaces:
      - network_name: private_network
        ip: 192.168.30.42
 provisioner:
  name: ansible
  env:
    ANSIBLE_VERBOSITY: 1
  playbooks:
    converge: ../resources/converge.yml
    side_effect: ../resources/reset.yml
    verify: ../resources/verify.yml
  inventory:
    links:
      group_vars: ../../inventory/sample/group_vars
 scenario:
  test_sequence:
    - dependency
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    # idempotence is not possible with the playbook in its current form.
    - verify
    # We are repurposing side_effect here to test the reset playbook.
    # This is why we do not run it before verify (which tests the cluster),
    # but after the verify step.
    - side_effect
    - cleanup
    - destroy
--- a/molecule/default/overrides.yml
+++ b/molecule/default/overrides.yml
@@ -0,0 +1,12 @@
 ---
 - name: Apply overrides
  hosts: all
  tasks:
    - name: Override host variables
      ansible.builtin.set_fact:
        # See:
        # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
        flannel_iface: eth1
        # The test VMs might be a bit slow, so we give them more time to join the cluster:
        retry_count: 45
--- a/molecule/default/prepare.yml
+++ b/molecule/default/prepare.yml
@@ -0,0 +1,22 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Network setup
  hosts: all
  tasks:
    - name: Disable firewalld
      when: ansible_distribution == "Rocky"
      # Rocky Linux comes with firewalld enabled. It blocks some of the network
      # connections needed for our k3s cluster. For our test setup, we just disable
      # it since the VM host's firewall is still active for connections to and from
      # the Internet.
      # When building your own cluster, please DO NOT blindly copy this. Instead,
      # please create a custom firewall configuration that fits your network design
      # and security needs.
      ansible.builtin.systemd:
        name: firewalld
        enabled: false
        state: stopped
      become: true
--- a/molecule/ipv6/README.md
+++ b/molecule/ipv6/README.md
@@ -0,0 +1,35 @@
 # Sample IPv6 configuration for `k3s-ansible`
 This scenario contains a cluster configuration which is _IPv6 first_, but still supports dual-stack networking with IPv4 for most things.
 This means:
 - The API server VIP is an IPv6 address.
 - The MetalLB pool consists of both IPv4 and IPv4 addresses.
 - Nodes as well as cluster-internal resources (pods and services) are accessible via IPv4 as well as IPv6.
 ## Network design
 All IPv6 addresses used in this scenario share a single `/48` prefix: `fdad:bad:ba55`.
 The following subnets are used:
 - `fdad:bad:ba55:`**`0`**`::/64` is the subnet which contains the cluster components meant for external access.
  That includes:
  - The VIP for the Kubernetes API server: `fdad:bad:ba55::333`
  - Services load-balanced by MetalLB: `fdad:bad:ba55::1b:0/112`
  - Cluster nodes: `fdad:bad:ba55::de:0/112`
  - The host executing Vagrant: `fdad:bad:ba55::1`
  In a home lab setup, this might be your LAN.
 - `fdad:bad:ba55:`**`4200`**`::/56` is used internally by the cluster for pods.
 - `fdad:bad:ba55:`**`4300`**`::/108` is used internally by the cluster for services.
 IPv4 networking is also available:
 - The nodes have addresses inside `192.168.123.0/24`.
  MetalLB also has a bit of address space in this range: `192.168.123.80-192.168.123.90`
 - For pods and services, the k3s defaults (`10.42.0.0/16` and `10.43.0.0/16)` are used.
 Note that the host running Vagrant is not part any of these IPv4 networks.
--- a/molecule/ipv6/host_vars/control1.yml
+++ b/molecule/ipv6/host_vars/control1.yml
@@ -0,0 +1,3 @@
 ---
 node_ipv4: 192.168.123.11
 node_ipv6: fdad:bad:ba55::de:11
--- a/molecule/ipv6/host_vars/control2.yml
+++ b/molecule/ipv6/host_vars/control2.yml
@@ -0,0 +1,3 @@
 ---
 node_ipv4: 192.168.123.12
 node_ipv6: fdad:bad:ba55::de:12
--- a/molecule/ipv6/host_vars/node1.yml
+++ b/molecule/ipv6/host_vars/node1.yml
@@ -0,0 +1,3 @@
 ---
 node_ipv4: 192.168.123.21
 node_ipv6: fdad:bad:ba55::de:21
--- a/molecule/ipv6/molecule.yml
+++ b/molecule/ipv6/molecule.yml
@@ -0,0 +1,81 @@
 ---
 dependency:
  name: galaxy
 driver:
  name: vagrant
 platforms:
  - name: control1
    box: generic/ubuntu2204
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: fdad:bad:ba55::de:11
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
  - name: control2
    box: generic/ubuntu2204
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: fdad:bad:ba55::de:12
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
  - name: node1
    box: generic/ubuntu2204
    memory: 1024
    cpus: 2
    groups:
      - k3s_cluster
      - node
    interfaces:
      - network_name: private_network
        ip: fdad:bad:ba55::de:21
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
 provisioner:
  name: ansible
  env:
    ANSIBLE_VERBOSITY: 1
  playbooks:
    converge: ../resources/converge.yml
    side_effect: ../resources/reset.yml
    verify: ../resources/verify.yml
  inventory:
    links:
      group_vars: ../../inventory/sample/group_vars
 scenario:
  test_sequence:
    - dependency
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    # idempotence is not possible with the playbook in its current form.
    - verify
    # We are repurposing side_effect here to test the reset playbook.
    # This is why we do not run it before verify (which tests the cluster),
    # but after the verify step.
    - side_effect
    - cleanup
    - destroy
--- a/molecule/ipv6/overrides.yml
+++ b/molecule/ipv6/overrides.yml
@@ -0,0 +1,51 @@
 ---
 - name: Apply overrides
  hosts: all
  tasks:
    - name: Override host variables (1/2)
      ansible.builtin.set_fact:
        # See:
        # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
        flannel_iface: eth1
        # In this scenario, we have multiple interfaces that the VIP could be
        # broadcasted on. Since we have assigned a dedicated private network
        # here, let's make sure that it is used.
        kube_vip_iface: eth1
        # The test VMs might be a bit slow, so we give them more time to join the cluster:
        retry_count: 45
        # IPv6 configuration
        # ######################################################################
        # The API server will be reachable on IPv6 only
        apiserver_endpoint: fdad:bad:ba55::333
        # We give MetalLB address space for both IPv4 and IPv6
        metal_lb_ip_range:
          - fdad:bad:ba55::1b:0/112
          - 192.168.123.80-192.168.123.90
        # k3s_node_ip is by default set to the IPv4 address of flannel_iface.
        # We want IPv6 addresses here of course, so we just specify them
        # manually below.
        k3s_node_ip: "{{ node_ipv4 }},{{ node_ipv6 }}"
    - name: Override host variables (2/2)
      # Since "extra_args" depends on "k3s_node_ip" and "flannel_iface" we have
      # to set this AFTER overriding the both of them.
      ansible.builtin.set_fact:
        # A few extra server args are necessary:
        #  - the network policy needs to be disabled.
        #  - we need to manually specify the subnets for services and pods, as
        #    the default has IPv4 ranges only.
        extra_server_args: >-
          {{ extra_args }}
          --tls-san {{ apiserver_endpoint }}
          {{ '--node-taint node-role.kubernetes.io/master=true:NoSchedule' if k3s_master_taint else '' }}
          --disable servicelb
          --disable traefik
          --disable-network-policy
          --cluster-cidr=10.42.0.0/16,fdad:bad:ba55:4200::/56
          --service-cidr=10.43.0.0/16,fdad:bad:ba55:4300::/108
--- a/molecule/ipv6/prepare.yml
+++ b/molecule/ipv6/prepare.yml
@@ -0,0 +1,51 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Configure dual-stack networking
  hosts: all
  become: true
  # Unfortunately, as of 2022-09, Vagrant does not support the configuration
  # of both IPv4 and IPv6 addresses for a single network adapter. So we have
  # to configure that ourselves.
  # Moreover, we have to explicitly enable IPv6 for the loopback interface.
  tasks:
    - name: Enable IPv6 for network interfaces
      ansible.posix.sysctl:
        name: net.ipv6.conf.{{ item }}.disable_ipv6
        value: "0"
      with_items:
        - all
        - default
        - lo
    - name: Disable duplicate address detection
      # Duplicate address detection did repeatedly fail within the virtual
      # network. But since this setup does not use SLAAC anyway, we can safely
      # disable it.
      ansible.posix.sysctl:
        name: net.ipv6.conf.{{ item }}.accept_dad
        value: "0"
      with_items:
        - "{{ flannel_iface }}"
    - name: Write IPv4 configuration
      ansible.builtin.template:
        src: 55-flannel-ipv4.yaml.j2
        dest: /etc/netplan/55-flannel-ipv4.yaml
        owner: root
        group: root
        mode: 0644
      register: netplan_template
    - name: Apply netplan configuration
      # Conceptually, this should be a handler rather than a task.
      # However, we are currently not in a role context - creating
      # one just for this seemed overkill.
      when: netplan_template.changed
      ansible.builtin.command:
        cmd: netplan apply
      changed_when: true
--- a/molecule/ipv6/templates/55-flannel-ipv4.yaml.j2
+++ b/molecule/ipv6/templates/55-flannel-ipv4.yaml.j2
@@ -0,0 +1,8 @@
 ---
 network:
  version: 2
  renderer: networkd
  ethernets:
    {{ flannel_iface }}:
      addresses:
      - {{ node_ipv4 }}/24
--- a/molecule/resources/converge.yml
+++ b/molecule/resources/converge.yml
@@ -0,0 +1,7 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Converge
  ansible.builtin.import_playbook: ../../site.yml
--- a/molecule/resources/reset.yml
+++ b/molecule/resources/reset.yml
@@ -0,0 +1,7 @@
 ---
 - name: Apply overrides
  ansible.builtin.import_playbook: >-
    {{ lookup("ansible.builtin.env", "MOLECULE_SCENARIO_DIRECTORY") }}/overrides.yml
 - name: Reset
  ansible.builtin.import_playbook: ../../reset.yml
--- a/molecule/resources/verify.yml
+++ b/molecule/resources/verify.yml
@@ -0,0 +1,5 @@
 ---
 - name: Verify
  hosts: all
  roles:
    - verify_from_outside
--- a/molecule/resources/verify_from_outside/defaults/main.yml
+++ b/molecule/resources/verify_from_outside/defaults/main.yml
@@ -0,0 +1,9 @@
 ---
 # A host outside of the cluster from which the checks shall be performed
 outside_host: localhost
 # This kubernetes namespace will be used for testing
 testing_namespace: molecule-verify-from-outside
 # The directory in which the example manifests reside
 example_manifests_path: ../../../example
--- a/molecule/resources/verify_from_outside/tasks/kubecfg-cleanup.yml
+++ b/molecule/resources/verify_from_outside/tasks/kubecfg-cleanup.yml
@@ -0,0 +1,5 @@
 ---
 - name: Clean up kubecfg
  ansible.builtin.file:
    path: "{{ kubecfg.path }}"
    state: absent
--- a/molecule/resources/verify_from_outside/tasks/kubecfg-fetch.yml
+++ b/molecule/resources/verify_from_outside/tasks/kubecfg-fetch.yml
@@ -0,0 +1,19 @@
 ---
 - name: Create temporary directory for kubecfg
  ansible.builtin.tempfile:
    state: directory
    suffix: kubecfg
  register: kubecfg
 - name: Gathering facts
  delegate_to: "{{ groups['master'][0] }}"
  ansible.builtin.gather_facts:
 - name: Download kubecfg
  ansible.builtin.fetch:
    src: "{{ ansible_env.HOME }}/.kube/config"
    dest: "{{ kubecfg.path }}/"
    flat: true
  delegate_to: "{{ groups['master'][0] }}"
  delegate_facts: true
 - name: Store path to kubecfg
  ansible.builtin.set_fact:
    kubecfg_path: "{{ kubecfg.path }}/config"
--- a/molecule/resources/verify_from_outside/tasks/main.yml
+++ b/molecule/resources/verify_from_outside/tasks/main.yml
@@ -0,0 +1,14 @@
 ---
 - name: Verify
  run_once: true
  delegate_to: "{{ outside_host }}"
  block:
    - name: "Test CASE: Get kube config"
      ansible.builtin.import_tasks: kubecfg-fetch.yml
    - name: "TEST CASE: Get nodes"
      ansible.builtin.include_tasks: test/get-nodes.yml
    - name: "TEST CASE: Deploy example"
      ansible.builtin.include_tasks: test/deploy-example.yml
  always:
    - name: "TEST CASE: Cleanup"
      ansible.builtin.import_tasks: kubecfg-cleanup.yml
--- a/molecule/resources/verify_from_outside/tasks/test/deploy-example.yml
+++ b/molecule/resources/verify_from_outside/tasks/test/deploy-example.yml
@@ -0,0 +1,58 @@
 ---
 - name: Deploy example
  block:
    - name: "Create namespace: {{ testing_namespace }}"
      kubernetes.core.k8s:
        api_version: v1
        kind: Namespace
        name: "{{ testing_namespace }}"
        state: present
        wait: true
        kubeconfig: "{{ kubecfg_path }}"
    - name: Apply example manifests
      kubernetes.core.k8s:
        src: "{{ example_manifests_path }}/{{ item }}"
        namespace: "{{ testing_namespace }}"
        state: present
        wait: true
        kubeconfig: "{{ kubecfg_path }}"
      with_items:
        - deployment.yml
        - service.yml
    - name: Get info about nginx service
      kubernetes.core.k8s_info:
        kind: service
        name: nginx
        namespace: "{{ testing_namespace }}"
        kubeconfig: "{{ kubecfg_path }}"
      vars: &load_balancer_metadata
        metallb_ip: status.loadBalancer.ingress[0].ip
        metallb_port: spec.ports[0].port
      register: nginx_services
    - name: Assert that the nginx welcome page is available
      ansible.builtin.uri:
        url: http://{{ ip | ansible.utils.ipwrap }}:{{ port_ }}/
        return_content: true
      register: result
      failed_when: "'Welcome to nginx!' not in result.content"
      vars:
        ip: >-
          {{ nginx_services.resources[0].status.loadBalancer.ingress[0].ip }}
        port_: >-
          {{ nginx_services.resources[0].spec.ports[0].port }}
      # Deactivated linter rules:
      #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
      #                     would be undefined. This will not be the case during playbook execution.
      # noqa jinja[invalid]
  always:
    - name: "Remove namespace: {{ testing_namespace }}"
      kubernetes.core.k8s:
        api_version: v1
        kind: Namespace
        name: "{{ testing_namespace }}"
        state: absent
        kubeconfig: "{{ kubecfg_path }}"
--- a/molecule/resources/verify_from_outside/tasks/test/get-nodes.yml
+++ b/molecule/resources/verify_from_outside/tasks/test/get-nodes.yml
@@ -0,0 +1,28 @@
 ---
 - name: Get all nodes in cluster
  kubernetes.core.k8s_info:
    kind: node
    kubeconfig: "{{ kubecfg_path }}"
  register: cluster_nodes
 - name: Assert that the cluster contains exactly the expected nodes
  ansible.builtin.assert:
    that: found_nodes == expected_nodes
    success_msg: "Found nodes as expected: {{ found_nodes }}"
    fail_msg: "Expected nodes {{ expected_nodes }}, but found nodes {{ found_nodes }}"
  vars:
    found_nodes: >-
      {{ cluster_nodes | json_query('resources[*].metadata.name') | unique | sort }}
    expected_nodes: |-
      {{
        (
          ( groups['master'] | default([]) ) +
          ( groups['node'] | default([]) )
        )
        | unique
        | sort
      }}
  # Deactivated linter rules:
  #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
  #                     would be undefined. This will not be the case during playbook execution.
  # noqa jinja[invalid]
--- a/molecule/single_node/molecule.yml
+++ b/molecule/single_node/molecule.yml
@@ -0,0 +1,49 @@
 ---
 dependency:
  name: galaxy
 driver:
  name: vagrant
 platforms:
  - name: control1
    box: generic/ubuntu2204
    memory: 4096
    cpus: 4
    config_options:
      # We currently can not use public-key based authentication on Ubuntu 22.04,
      # see: https://github.com/chef/bento/issues/1405
      ssh.username: "vagrant"
      ssh.password: "vagrant"
    groups:
      - k3s_cluster
      - master
    interfaces:
      - network_name: private_network
        ip: 192.168.30.50
 provisioner:
  name: ansible
  env:
    ANSIBLE_VERBOSITY: 1
  playbooks:
    converge: ../resources/converge.yml
    side_effect: ../resources/reset.yml
    verify: ../resources/verify.yml
  inventory:
    links:
      group_vars: ../../inventory/sample/group_vars
 scenario:
  test_sequence:
    - dependency
    - cleanup
    - destroy
    - syntax
    - create
    - prepare
    - converge
    # idempotence is not possible with the playbook in its current form.
    - verify
    # We are repurposing side_effect here to test the reset playbook.
    # This is why we do not run it before verify (which tests the cluster),
    # but after the verify step.
    - side_effect
    - cleanup
    - destroy
--- a/molecule/single_node/overrides.yml
+++ b/molecule/single_node/overrides.yml
@@ -0,0 +1,16 @@
 ---
 - name: Apply overrides
  hosts: all
  tasks:
    - name: Override host variables
      ansible.builtin.set_fact:
        # See:
        # https://github.com/flannel-io/flannel/blob/67d603aaf45ef80f5dd39f43714fc5e6f8a637eb/Documentation/troubleshooting.md#Vagrant
        flannel_iface: eth1
        # The test VMs might be a bit slow, so we give them more time to join the cluster:
        retry_count: 45
        # Make sure that our IP ranges do not collide with those of the default scenario
        apiserver_endpoint: "192.168.30.223"
        metal_lb_ip_range: "192.168.30.91-192.168.30.99"
--- a/reboot.sh
+++ b/reboot.sh
@@ -0,0 +1,3 @@
 #!/bin/bash
 ansible-playbook reboot.yml
--- a/reboot.yml
+++ b/reboot.yml
@@ -0,0 +1,9 @@
 ---
 - name: Reboot k3s_cluster
  hosts: k3s_cluster
  gather_facts: true
  tasks:
    - name: Reboot the nodes (and Wait upto 5 mins max)
      become: true
      reboot:
        reboot_timeout: 300
--- a/requirements.in
+++ b/requirements.in
@@ -0,0 +1,10 @@
 ansible-core>=2.16.2
 jmespath>=1.0.1
 jsonpatch>=1.33
 kubernetes>=29.0.0
 molecule-plugins[vagrant]
 molecule>=6.0.3
 netaddr>=0.10.1
 pre-commit>=3.6.0
 pre-commit-hooks>=4.5.0
 pyyaml>=6.0.1
--- a/requirements.txt
+++ b/requirements.txt
@@ -0,0 +1,169 @@
 #
 # This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
 #    pip-compile requirements.in
 #
 ansible-compat==4.1.11
    # via molecule
 ansible-core==2.16.2
    # via
    #   -r requirements.in
    #   ansible-compat
    #   molecule
 attrs==23.2.0
    # via
    #   jsonschema
    #   referencing
 bracex==2.4
    # via wcmatch
 cachetools==5.3.2
    # via google-auth
 certifi==2023.11.17
    # via
    #   kubernetes
    #   requests
 cffi==1.16.0
    # via cryptography
 cfgv==3.4.0
    # via pre-commit
 charset-normalizer==3.3.2
    # via requests
 click==8.1.7
    # via
    #   click-help-colors
    #   molecule
 click-help-colors==0.9.4
    # via molecule
 cryptography==41.0.7
    # via ansible-core
 distlib==0.3.8
    # via virtualenv
 enrich==1.2.7
    # via molecule
 filelock==3.13.1
    # via virtualenv
 google-auth==2.26.2
    # via kubernetes
 identify==2.5.33
    # via pre-commit
 idna==3.6
    # via requests
 jinja2==3.1.3
    # via
    #   ansible-core
    #   molecule
 jmespath==1.0.1
    # via -r requirements.in
 jsonpatch==1.33
    # via -r requirements.in
 jsonpointer==2.4
    # via jsonpatch
 jsonschema==4.21.1
    # via
    #   ansible-compat
    #   molecule
 jsonschema-specifications==2023.12.1
    # via jsonschema
 kubernetes==29.0.0
    # via -r requirements.in
 markdown-it-py==3.0.0
    # via rich
 markupsafe==2.1.4
    # via jinja2
 mdurl==0.1.2
    # via markdown-it-py
 molecule==6.0.3
    # via
    #   -r requirements.in
    #   molecule-plugins
 molecule-plugins[vagrant]==23.5.0
    # via -r requirements.in
 netaddr==0.10.1
    # via -r requirements.in
 nodeenv==1.8.0
    # via pre-commit
 oauthlib==3.2.2
    # via
    #   kubernetes
    #   requests-oauthlib
 packaging==23.2
    # via
    #   ansible-compat
    #   ansible-core
    #   molecule
 platformdirs==4.1.0
    # via virtualenv
 pluggy==1.3.0
    # via molecule
 pre-commit==3.6.0
    # via -r requirements.in
 pre-commit-hooks==4.5.0
    # via -r requirements.in
 pyasn1==0.5.1
    # via
    #   pyasn1-modules
    #   rsa
 pyasn1-modules==0.3.0
    # via google-auth
 pycparser==2.21
    # via cffi
 pygments==2.17.2
    # via rich
 python-dateutil==2.8.2
    # via kubernetes
 python-vagrant==1.0.0
    # via molecule-plugins
 pyyaml==6.0.1
    # via
    #   -r requirements.in
    #   ansible-compat
    #   ansible-core
    #   kubernetes
    #   molecule
    #   pre-commit
 referencing==0.32.1
    # via
    #   jsonschema
    #   jsonschema-specifications
 requests==2.31.0
    # via
    #   kubernetes
    #   requests-oauthlib
 requests-oauthlib==1.3.1
    # via kubernetes
 resolvelib==1.0.1
    # via ansible-core
 rich==13.7.0
    # via
    #   enrich
    #   molecule
 rpds-py==0.17.1
    # via
    #   jsonschema
    #   referencing
 rsa==4.9
    # via google-auth
 ruamel-yaml==0.18.5
    # via pre-commit-hooks
 ruamel-yaml-clib==0.2.8
    # via ruamel-yaml
 six==1.16.0
    # via
    #   kubernetes
    #   python-dateutil
 subprocess-tee==0.4.1
    # via ansible-compat
 urllib3==2.1.0
    # via
    #   kubernetes
    #   requests
 virtualenv==20.25.0
    # via pre-commit
 wcmatch==8.5
    # via molecule
 websocket-client==1.7.0
    # via kubernetes
 # The following packages are considered to be unsafe in a requirements file:
 # setuptools
--- a/reset.sh
+++ b/reset.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
-ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook reset.yml
--- a/reset.yml
+++ b/reset.yml
@@ -1,7 +1,24 @@
 ---
-
+- name: Reset k3s cluster
- hosts: k3s_cluster
+  hosts: k3s_cluster
-  gather_facts: yes
+  gather_facts: true
  become: yes
  roles:
    - role: reset
      become: true
    - role: raspberrypi
      become: true
      vars: {state: absent}
  post_tasks:
    - name: Reboot and wait for node to come back up
      become: true
      reboot:
        reboot_timeout: 3600
 - name: Revert changes to Proxmox cluster
  hosts: proxmox
  gather_facts: true
  become: true
  remote_user: "{{ proxmox_lxc_ssh_user }}"
  roles:
    - role: reset_proxmox_lxc
      when: proxmox_lxc_configure
--- a/roles/k3s/master/defaults/main.yml
+++ b/roles/k3s/master/defaults/main.yml
@@ -1,12 +0,0 @@
 ---
 ansible_user: root
 server_init_args: >-
  {% if groups['master'] | length > 1 %}
    {% if ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0]) %}
      --cluster-init
    {% else %}
      --server https://{{ hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0]) }}:6443
    {% endif %}
    --token {{ k3s_token }}
  {% endif %}
  {{ extra_server_args | default('') }}
--- a/roles/k3s/master/tasks/main.yml
+++ b/roles/k3s/master/tasks/main.yml
@@ -1,173 +0,0 @@
 ---
 - name: Clean previous runs of k3s-init
  systemd:
    name: k3s-init
    state: stopped
  failed_when: false
 - name: Clean previous runs of k3s-init
  command: systemctl reset-failed k3s-init
  failed_when: false
  changed_when: false
  args:
    warn: false  # The ansible systemd module does not support reset-failed
 - name: Create manifests directory on first master
  file:
    path: /var/lib/rancher/k3s/server/manifests
    state: directory
    owner: root
    group: root
    mode: 0644
  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 - name: Copy vip rbac manifest to first master
  template:
    src: "vip.rbac.yaml.j2"
    dest: "/var/lib/rancher/k3s/server/manifests/vip.rbac.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 - name: Copy vip manifest to first master
  template:
    src: "vip.yaml.j2"
    dest: "/var/lib/rancher/k3s/server/manifests/vip.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 - name: Copy metallb namespace manifest to first master
  template:
    src: "metallb.namespace.j2"
    dest: "/var/lib/rancher/k3s/server/manifests/metallb.namespace.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 - name: Copy metallb ConfigMap manifest to first master
  template:
    src: "metallb.configmap.j2"
    dest: "/var/lib/rancher/k3s/server/manifests/metallb.configmap.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 - name: Copy metallb main manifest to first master
  template:
    src: "metallb.yaml.j2"
    dest: "/var/lib/rancher/k3s/server/manifests/metallb.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_host == hostvars[groups['master'][0]]['ansible_host'] | default(groups['master'][0])
 - name: Init cluster inside the transient k3s-init service
  command:
    cmd: "systemd-run -p RestartSec=2 \
                      -p Restart=on-failure \
                      --unit=k3s-init \
                      k3s server {{ server_init_args }}"
    creates: "{{ systemd_dir }}/k3s.service"
  args:
    warn: false  # The ansible systemd module does not support transient units
 - name: Verification
  block:
    - name: Verify that all nodes actually joined (check k3s-init.service if this fails)
      command:
        cmd: k3s kubectl get nodes -l "node-role.kubernetes.io/master=true" -o=jsonpath="{.items[*].metadata.name}"
      register: nodes
      until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups['master'] | length)
      retries: "{{ retry_count | default(20) }}"
      delay: 10
      changed_when: false
  always:
    - name: Kill the temporary service used for initialization
      systemd:
        name: k3s-init
        state: stopped
      failed_when: false
 - name: Copy K3s service file
  register: k3s_service
  template:
    src: "k3s.service.j2"
    dest: "{{ systemd_dir }}/k3s.service"
    owner: root
    group: root
    mode: 0644
 - name: Enable and check K3s service
  systemd:
    name: k3s
    daemon_reload: yes
    state: restarted
    enabled: yes
 - name: Wait for node-token
  wait_for:
    path: /var/lib/rancher/k3s/server/node-token
 - name: Register node-token file access mode
  stat:
    path: /var/lib/rancher/k3s/server
  register: p
 - name: Change file access node-token
  file:
    path: /var/lib/rancher/k3s/server
    mode: "g+rx,o+rx"
 - name: Read node-token from master
  slurp:
    src: /var/lib/rancher/k3s/server/node-token
  register: node_token
 - name: Store Master node-token
  set_fact:
    token: "{{ node_token.content | b64decode | regex_replace('\n', '') }}"
 - name: Restore node-token file access
  file:
    path: /var/lib/rancher/k3s/server
    mode: "{{ p.stat.mode }}"
 - name: Create directory .kube
  file:
    path: ~{{ ansible_user }}/.kube
    state: directory
    owner: "{{ ansible_user }}"
    mode: "u=rwx,g=rx,o="
 - name: Copy config file to user home directory
  copy:
    src: /etc/rancher/k3s/k3s.yaml
    dest: ~{{ ansible_user }}/.kube/config
    remote_src: yes
    owner: "{{ ansible_user }}"
    mode: "u=rw,g=,o="
 - name: Configure kubectl cluster to https://{{ apiserver_endpoint }}:6443
  command: >-
    k3s kubectl config set-cluster default
      --server=https://{{ apiserver_endpoint }}:6443
      --kubeconfig ~{{ ansible_user }}/.kube/config
  changed_when: true
 - name: Create kubectl symlink
  file:
    src: /usr/local/bin/k3s
    dest: /usr/local/bin/kubectl
    state: link
 - name: Create crictl symlink
  file:
    src: /usr/local/bin/k3s
    dest: /usr/local/bin/crictl
    state: link
--- a/roles/k3s/master/templates/metallb.configmap.j2
+++ b/roles/k3s/master/templates/metallb.configmap.j2
@@ -1,13 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  namespace: metallb-system
  name: config
 data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
      - {{ metal_lb_ip_range }}
--- a/roles/k3s/master/templates/metallb.namespace.j2
+++ b/roles/k3s/master/templates/metallb.namespace.j2
@@ -1,7 +0,0 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: metallb-system
  labels:
    app: metallb
--- a/roles/k3s/master/templates/metallb.yaml.j2
+++ b/roles/k3s/master/templates/metallb.yaml.j2
@@ -1,481 +0,0 @@
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
  labels:
    app: metallb
  name: controller
 spec:
  allowPrivilegeEscalation: false
  allowedCapabilities: []
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - ALL
  runAsUser:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - configMap
  - secret
  - emptyDir
 ---
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
  labels:
    app: metallb
  name: speaker
 spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
  - NET_RAW
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    rule: RunAsAny
  hostIPC: false
  hostNetwork: true
  hostPID: false
  hostPorts:
  - max: 7472
    min: 7472
  - max: 7946
    min: 7946
  privileged: true
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - configMap
  - secret
  - emptyDir
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  labels:
    app: metallb
  name: speaker
  namespace: metallb-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  labels:
    app: metallb
  name: metallb-system:controller
 rules:
 - apiGroups:
  - ''
  resources:
  - services
  verbs:
  - get
  - list
  - watch
 - apiGroups:
  - ''
  resources:
  - services/status
  verbs:
  - update
 - apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - patch
 - apiGroups:
  - policy
  resourceNames:
  - controller
  resources:
  - podsecuritypolicies
  verbs:
  - use
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
 rules:
 - apiGroups:
  - ''
  resources:
  - services
  - endpoints
  - nodes
  verbs:
  - get
  - list
  - watch
 - apiGroups: ["discovery.k8s.io"]
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
 - apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - patch
 - apiGroups:
  - policy
  resourceNames:
  - speaker
  resources:
  - podsecuritypolicies
  verbs:
  - use
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  labels:
    app: metallb
  name: config-watcher
  namespace: metallb-system
 rules:
 - apiGroups:
  - ''
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
 rules:
 - apiGroups:
  - ''
  resources:
  - pods
  verbs:
  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
 rules:
 - apiGroups:
  - ''
  resources:
  - secrets
  verbs:
  - create
 - apiGroups:
  - ''
  resources:
  - secrets
  resourceNames:
  - memberlist
  verbs:
  - list
 - apiGroups:
  - apps
  resources:
  - deployments
  resourceNames:
  - controller
  verbs:
  - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  labels:
    app: metallb
  name: metallb-system:controller
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:controller
 subjects:
 - kind: ServiceAccount
  name: controller
  namespace: metallb-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:speaker
 subjects:
 - kind: ServiceAccount
  name: speaker
  namespace: metallb-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  labels:
    app: metallb
  name: config-watcher
  namespace: metallb-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: config-watcher
 subjects:
 - kind: ServiceAccount
  name: controller
 - kind: ServiceAccount
  name: speaker
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-lister
 subjects:
 - kind: ServiceAccount
  name: speaker
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: controller
 subjects:
 - kind: ServiceAccount
  name: controller
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  labels:
    app: metallb
    component: speaker
  name: speaker
  namespace: metallb-system
 spec:
  selector:
    matchLabels:
      app: metallb
      component: speaker
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: speaker
    spec:
      containers:
      - args:
        - --port=7472
        - --config=config
        - --log-level=info
        env:
        - name: METALLB_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: METALLB_HOST
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: METALLB_ML_BIND_ADDR
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        # needed when another software is also using memberlist / port 7946
        # when changing this default you also need to update the container ports definition
        # and the PodSecurityPolicy hostPorts definition
        #- name: METALLB_ML_BIND_PORT
        #  value: "7946"
        - name: METALLB_ML_LABELS
          value: "app=metallb,component=speaker"
        - name: METALLB_ML_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: memberlist
              key: secretkey
        image: quay.io/metallb/speaker:{{ metal_lb_speaker_tag_version }}
        name: speaker
        ports:
        - containerPort: 7472
          name: monitoring
        - containerPort: 7946
          name: memberlist-tcp
        - containerPort: 7946
          name: memberlist-udp
          protocol: UDP
        livenessProbe:
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 1
          successThreshold: 1
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 1
          successThreshold: 1
          failureThreshold: 3
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_RAW
            drop:
            - ALL
          readOnlyRootFilesystem: true
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  labels:
    app: metallb
    component: controller
  name: controller
  namespace: metallb-system
 spec:
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: metallb
      component: controller
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: controller
    spec:
      containers:
      - args:
        - --port=7472
        - --config=config
        - --log-level=info
        env:
        - name: METALLB_ML_SECRET_NAME
          value: memberlist
        - name: METALLB_DEPLOYMENT
          value: controller
        image: quay.io/metallb/controller:{{ metal_lb_controller_tag_version }}
        name: controller
        ports:
        - containerPort: 7472
          name: monitoring
        livenessProbe:
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 1
          successThreshold: 1
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 1
          successThreshold: 1
          failureThreshold: 3
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          readOnlyRootFilesystem: true
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        fsGroup: 65534
      serviceAccountName: controller
      terminationGracePeriodSeconds: 0
--- a/roles/k3s/master/templates/vip.rbac.yaml.j2
+++ b/roles/k3s/master/templates/vip.rbac.yaml.j2
@@ -1,33 +0,0 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: kube-vip
  namespace: kube-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: system:kube-vip-role
 rules:
  - apiGroups: [""]
    resources: ["services", "services/status", "nodes"]
    verbs: ["list","get","watch", "update"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["list", "get", "watch", "update", "create"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
  name: system:kube-vip-binding
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:kube-vip-role
 subjects:
 - kind: ServiceAccount
  name: kube-vip
  namespace: kube-system
--- a/roles/k3s/node/defaults/main.yml
+++ b/roles/k3s/node/defaults/main.yml
@@ -0,0 +1,3 @@
 ---
 # Name of the master group
 group_name_master: master
--- a/roles/k3s_agent/tasks/http_proxy.yml
+++ b/roles/k3s_agent/tasks/http_proxy.yml
@@ -0,0 +1,18 @@
 ---
 - name: Create k3s-node.service.d directory
  file:
    path: '{{ systemd_dir }}/k3s-node.service.d'
    state: directory
    owner: root
    group: root
    mode: '0755'
 - name: Copy K3s http_proxy conf file
  template:
    src: "http_proxy.conf.j2"
    dest: "{{ systemd_dir }}/k3s-node.service.d/http_proxy.conf"
    owner: root
    group: root
    mode: '0755'
--- a/roles/k3s_agent/tasks/main.yml
+++ b/roles/k3s_agent/tasks/main.yml
@@ -1,5 +1,9 @@
 ---
 - name: Deploy K3s http_proxy conf
  include_tasks: http_proxy.yml
  when: proxy_env is defined
 - name: Copy K3s service file
  template:
    src: "k3s.service.j2"
@@ -11,6 +15,6 @@
 - name: Enable and check K3s service
  systemd:
    name: k3s-node
-    daemon_reload: yes
+    daemon_reload: true
    state: restarted
-    enabled: yes
+    enabled: true
--- a/roles/k3s_agent/templates/http_proxy.conf.j2
+++ b/roles/k3s_agent/templates/http_proxy.conf.j2
@@ -0,0 +1,4 @@
 [Service]
 Environment=HTTP_PROXY={{ proxy_env.HTTP_PROXY }}
 Environment=HTTPS_PROXY={{ proxy_env.HTTPS_PROXY }}
 Environment=NO_PROXY={{ proxy_env.NO_PROXY }}
--- a/roles/k3s_agent/templates/k3s.service.j2
+++ b/roles/k3s_agent/templates/k3s.service.j2
@@ -7,7 +7,7 @@ After=network-online.target
 Type=notify
 ExecStartPre=-/sbin/modprobe br_netfilter
 ExecStartPre=-/sbin/modprobe overlay
-ExecStart=/usr/local/bin/k3s agent --server https://{{ apiserver_endpoint }}:6443 --token {{ hostvars[groups['master'][0]]['token'] | default(k3s_token) }} {{ extra_agent_args | default("") }}
+ExecStart=/usr/local/bin/k3s agent --server https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443 --token {{ hostvars[groups[group_name_master | default('master')][0]]['token'] | default(k3s_token) }} {{ extra_agent_args | default("") }}
 KillMode=process
 Delegate=yes
 # Having non-zero Limit*s causes performance problems due to accounting overhead
--- a/roles/k3s_custom_registries/defaults/main.yml
+++ b/roles/k3s_custom_registries/defaults/main.yml
@@ -0,0 +1,6 @@
 ---
 # Indicates whether custom registries for k3s should be configured
 # Possible values:
 #   - present
 #   - absent
 state: present
--- a/roles/k3s_custom_registries/tasks/main.yml
+++ b/roles/k3s_custom_registries/tasks/main.yml
@@ -0,0 +1,17 @@
 ---
 - name: Create directory /etc/rancher/k3s
  file:
    path: "/etc/{{ item }}"
    state: directory
    mode: '0755'
  loop:
    - rancher
    - rancher/k3s
 - name: Insert registries into /etc/rancher/k3s/registries.yaml
  blockinfile:
    path: /etc/rancher/k3s/registries.yaml
    block: "{{ custom_registries_yaml }}"
    mode: '0600'
    create: true
--- a/roles/k3s_server/defaults/main.yml
+++ b/roles/k3s_server/defaults/main.yml
@@ -0,0 +1,20 @@
 ---
 # If you want to explicitly define an interface that ALL control nodes
 # should use to propagate the VIP, define it here. Otherwise, kube-vip
 # will determine the right interface automatically at runtime.
 kube_vip_iface: null
 # Name of the master group
 group_name_master: master
 # yamllint disable rule:line-length
 server_init_args: >-
  {% if groups[group_name_master | default('master')] | length > 1 %}
    {% if ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname'] %}
      --cluster-init
    {% else %}
      --server https://{{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip | split(",") | first | ansible.utils.ipwrap }}:6443
    {% endif %}
    --token {{ k3s_token }}
  {% endif %}
  {{ extra_server_args | default('') }}
--- a/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
+++ b/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
@@ -0,0 +1,28 @@
 ---
 # Download logs of k3s-init.service from the nodes to localhost.
 # Note that log_destination must be set.
 - name: Fetch k3s-init.service logs
  ansible.builtin.command:
    cmd: journalctl --all --unit=k3s-init.service
  changed_when: false
  register: k3s_init_log
 - name: Create {{ log_destination }}
  delegate_to: localhost
  run_once: true
  become: false
  ansible.builtin.file:
    path: "{{ log_destination }}"
    state: directory
    mode: "0755"
 - name: Store logs to {{ log_destination }}
  delegate_to: localhost
  become: false
  ansible.builtin.template:
    src: content.j2
    dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
    mode: 0644
  vars:
    content: "{{ k3s_init_log.stdout }}"
--- a/roles/k3s_server/tasks/http_proxy.yml
+++ b/roles/k3s_server/tasks/http_proxy.yml
@@ -0,0 +1,18 @@
 ---
 - name: Create k3s.service.d directory
  file:
    path: '{{ systemd_dir }}/k3s.service.d'
    state: directory
    owner: root
    group: root
    mode: '0755'
 - name: Copy K3s http_proxy conf file
  template:
    src: "http_proxy.conf.j2"
    dest: "{{ systemd_dir }}/k3s.service.d/http_proxy.conf"
    owner: root
    group: root
    mode: '0755'
--- a/roles/k3s_server/tasks/main.yml
+++ b/roles/k3s_server/tasks/main.yml
@@ -0,0 +1,170 @@
 ---
 - name: Stop k3s-init
  systemd:
    name: k3s-init
    state: stopped
  failed_when: false
 # k3s-init won't work if the port is already in use
 - name: Stop k3s
  systemd:
    name: k3s
    state: stopped
  failed_when: false
 - name: Clean previous runs of k3s-init  # noqa command-instead-of-module
  # The systemd module does not support "reset-failed", so we need to resort to command.
  command: systemctl reset-failed k3s-init
  failed_when: false
  changed_when: false
 - name: Deploy K3s http_proxy conf
  include_tasks: http_proxy.yml
  when: proxy_env is defined
 - name: Deploy vip manifest
  include_tasks: vip.yml
 - name: Deploy metallb manifest
  include_tasks: metallb.yml
  tags: metallb
 - name: Init cluster inside the transient k3s-init service
  command:
    cmd: "systemd-run -p RestartSec=2 \
                      -p Restart=on-failure \
                      --unit=k3s-init \
                      k3s server {{ server_init_args }}"
    creates: "{{ systemd_dir }}/k3s-init.service"
 - name: Verification
  when: not ansible_check_mode
  block:
    - name: Verify that all nodes actually joined (check k3s-init.service if this fails)
      command:
        cmd: k3s kubectl get nodes -l "node-role.kubernetes.io/master=true" -o=jsonpath="{.items[*].metadata.name}"
      register: nodes
      until: nodes.rc == 0 and (nodes.stdout.split() | length) == (groups[group_name_master | default('master')] | length)  # yamllint disable-line rule:line-length
      retries: "{{ retry_count | default(20) }}"
      delay: 10
      changed_when: false
  always:
    - name: Save logs of k3s-init.service
      include_tasks: fetch_k3s_init_logs.yml
      when: log_destination
      vars:
        log_destination: >-
          {{ lookup('ansible.builtin.env', 'ANSIBLE_K3S_LOG_DIR', default=False) }}
    - name: Kill the temporary service used for initialization
      systemd:
        name: k3s-init
        state: stopped
      failed_when: false
 - name: Copy K3s service file
  register: k3s_service
  template:
    src: "k3s.service.j2"
    dest: "{{ systemd_dir }}/k3s.service"
    owner: root
    group: root
    mode: 0644
 - name: Enable and check K3s service
  systemd:
    name: k3s
    daemon_reload: true
    state: restarted
    enabled: true
 - name: Wait for node-token
  wait_for:
    path: /var/lib/rancher/k3s/server/node-token
 - name: Register node-token file access mode
  stat:
    path: /var/lib/rancher/k3s/server
  register: p
 - name: Change file access node-token
  file:
    path: /var/lib/rancher/k3s/server
    mode: "g+rx,o+rx"
 - name: Read node-token from master
  slurp:
    src: /var/lib/rancher/k3s/server/node-token
  register: node_token
 - name: Store Master node-token
  set_fact:
    token: "{{ node_token.content | b64decode | regex_replace('\n', '') }}"
 - name: Restore node-token file access
  file:
    path: /var/lib/rancher/k3s/server
    mode: "{{ p.stat.mode }}"
 - name: Create directory .kube
  file:
    path: "{{ ansible_user_dir }}/.kube"
    state: directory
    owner: "{{ ansible_user_id }}"
    mode: "u=rwx,g=rx,o="
 - name: Copy config file to user home directory
  copy:
    src: /etc/rancher/k3s/k3s.yaml
    dest: "{{ ansible_user_dir }}/.kube/config"
    remote_src: true
    owner: "{{ ansible_user_id }}"
    mode: "u=rw,g=,o="
 - name: Configure kubectl cluster to {{ endpoint_url }}
  command: >-
    k3s kubectl config set-cluster default
      --server={{ endpoint_url }}
      --kubeconfig {{ ansible_user_dir }}/.kube/config
  changed_when: true
  vars:
    endpoint_url: >-
      https://{{ apiserver_endpoint | ansible.utils.ipwrap }}:6443
  # Deactivated linter rules:
  #   - jinja[invalid]: As of version 6.6.0, ansible-lint complains that the input to ipwrap
  #                     would be undefined. This will not be the case during playbook execution.
  # noqa jinja[invalid]
 - name: Create kubectl symlink
  file:
    src: /usr/local/bin/k3s
    dest: /usr/local/bin/kubectl
    state: link
 - name: Create crictl symlink
  file:
    src: /usr/local/bin/k3s
    dest: /usr/local/bin/crictl
    state: link
 - name: Get contents of manifests folder
  find:
    paths: /var/lib/rancher/k3s/server/manifests
    file_type: file
  register: k3s_server_manifests
 - name: Get sub dirs of manifests folder
  find:
    paths: /var/lib/rancher/k3s/server/manifests
    file_type: directory
  register: k3s_server_manifests_directories
 - name: Remove manifests and folders that are only needed for bootstrapping cluster so k3s doesn't auto apply on start
  file:
    path: "{{ item.path }}"
    state: absent
  with_items:
    - "{{ k3s_server_manifests.files }}"
    - "{{ k3s_server_manifests_directories.files }}"
  loop_control:
    label: "{{ item.path }}"
--- a/roles/k3s_server/tasks/metallb.yml
+++ b/roles/k3s_server/tasks/metallb.yml
@@ -0,0 +1,30 @@
 ---
 - name: Create manifests directory on first master
  file:
    path: /var/lib/rancher/k3s/server/manifests
    state: directory
    owner: root
    group: root
    mode: 0644
  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
 - name: "Download to first master: manifest for metallb-{{ metal_lb_type }}"
  ansible.builtin.get_url:
    url: "https://raw.githubusercontent.com/metallb/metallb/{{ metal_lb_controller_tag_version }}/config/manifests/metallb-{{ metal_lb_type }}.yaml"  # noqa yaml[line-length]
    dest: "/var/lib/rancher/k3s/server/manifests/metallb-crds.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
 - name: Set image versions in manifest for metallb-{{ metal_lb_type }}
  ansible.builtin.replace:
    path: "/var/lib/rancher/k3s/server/manifests/metallb-crds.yaml"
    regexp: "{{ item.change | ansible.builtin.regex_escape }}"
    replace: "{{ item.to }}"
  with_items:
    - change: "metallb/speaker:{{ metal_lb_controller_tag_version }}"
      to: "metallb/speaker:{{ metal_lb_speaker_tag_version }}"
  loop_control:
    label: "{{ item.change }} => {{ item.to }}"
  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
--- a/roles/k3s_server/tasks/vip.yml
+++ b/roles/k3s_server/tasks/vip.yml
@@ -0,0 +1,27 @@
 ---
 - name: Create manifests directory on first master
  file:
    path: /var/lib/rancher/k3s/server/manifests
    state: directory
    owner: root
    group: root
    mode: 0644
  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
 - name: Download vip rbac manifest to first master
  ansible.builtin.get_url:
    url: "https://raw.githubusercontent.com/kube-vip/kube-vip/{{ kube_vip_tag_version }}/docs/manifests/rbac.yaml"
    dest: "/var/lib/rancher/k3s/server/manifests/vip-rbac.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
 - name: Copy vip manifest to first master
  template:
    src: "vip.yaml.j2"
    dest: "/var/lib/rancher/k3s/server/manifests/vip.yaml"
    owner: root
    group: root
    mode: 0644
  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
--- a/roles/k3s_server/templates/content.j2
+++ b/roles/k3s_server/templates/content.j2
@@ -0,0 +1,5 @@
 {#
    This is a really simple template that just outputs the
    value of the "content" variable.
 #}
 {{ content }}
--- a/roles/k3s_server/templates/http_proxy.conf.j2
+++ b/roles/k3s_server/templates/http_proxy.conf.j2
@@ -0,0 +1,4 @@
 [Service]
 Environment=HTTP_PROXY={{ proxy_env.HTTP_PROXY }}
 Environment=HTTPS_PROXY={{ proxy_env.HTTPS_PROXY }}
 Environment=NO_PROXY={{ proxy_env.NO_PROXY }}
--- a/roles/k3s_server/templates/k3s.service.j2
+++ b/roles/k3s_server/templates/k3s.service.j2
--- a/roles/k3s_server/templates/vip.yaml.j2
+++ b/roles/k3s_server/templates/vip.yaml.j2
@@ -1,7 +1,6 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  creationTimestamp: null
  name: kube-vip-ds
  namespace: kube-system
 spec:
@@ -10,7 +9,6 @@ spec:
      name: kube-vip-ds
  template:
    metadata:
      creationTimestamp: null
      labels:
        name: kube-vip-ds
    spec:
@@ -32,10 +30,12 @@ spec:
          value: "true"
        - name: port
          value: "6443"
 {% if kube_vip_iface %}
        - name: vip_interface
-          value: {{ flannel_iface }}
+          value: {{ kube_vip_iface }}
 {% endif %}
        - name: vip_cidr
-          value: "32"
+          value: "{{ apiserver_endpoint | ansible.utils.ipsubnet | ansible.utils.ipaddr('prefix') }}"
        - name: cp_enable
          value: "true"
        - name: cp_namespace
--- a/roles/k3s_server_post/defaults/main.yml
+++ b/roles/k3s_server_post/defaults/main.yml
@@ -0,0 +1,6 @@
 ---
 # Timeout to wait for MetalLB services to come up
 metal_lb_available_timeout: 240s
 # Name of the master group
 group_name_master: master
--- a/roles/k3s_server_post/tasks/main.yml
+++ b/roles/k3s_server_post/tasks/main.yml
@@ -0,0 +1,9 @@
 ---
 - name: Deploy metallb pool
  include_tasks: metallb.yml
  tags: metallb
 - name: Remove tmp directory used for manifests
  file:
    path: /tmp/k3s
    state: absent
--- a/roles/k3s_server_post/tasks/metallb.yml
+++ b/roles/k3s_server_post/tasks/metallb.yml
@@ -0,0 +1,101 @@
 ---
 - name: Create manifests directory for temp configuration
  file:
    path: /tmp/k3s
    state: directory
    owner: "{{ ansible_user_id }}"
    mode: 0755
  with_items: "{{ groups[group_name_master | default('master')] }}"
  run_once: true
 - name: Copy metallb CRs manifest to first master
  template:
    src: "metallb.crs.j2"
    dest: "/tmp/k3s/metallb-crs.yaml"
    owner: "{{ ansible_user_id }}"
    mode: 0755
  with_items: "{{ groups[group_name_master | default('master')] }}"
  run_once: true
 - name: Test metallb-system namespace
  command: >-
    k3s kubectl -n metallb-system
  changed_when: false
  with_items: "{{ groups[group_name_master | default('master')] }}"
  run_once: true
 - name: Wait for MetalLB resources
  command: >-
    k3s kubectl wait {{ item.resource }}
    --namespace='metallb-system'
    {% if item.name | default(False) -%}{{ item.name }}{%- endif %}
    {% if item.selector | default(False) -%}--selector='{{ item.selector }}'{%- endif %}
    {% if item.condition | default(False) -%}{{ item.condition }}{%- endif %}
    --timeout='{{ metal_lb_available_timeout }}'
  changed_when: false
  run_once: true
  with_items:
    - description: controller
      resource: deployment
      name: controller
      condition: --for condition=Available=True
    - description: webhook service
      resource: pod
      selector: component=controller
      condition: --for=jsonpath='{.status.phase}'=Running
    - description: pods in replica sets
      resource: pod
      selector: component=controller,app=metallb
      condition: --for condition=Ready
    - description: ready replicas of controller
      resource: replicaset
      selector: component=controller,app=metallb
      condition: --for=jsonpath='{.status.readyReplicas}'=1
    - description: fully labeled replicas of controller
      resource: replicaset
      selector: component=controller,app=metallb
      condition: --for=jsonpath='{.status.fullyLabeledReplicas}'=1
    - description: available replicas of controller
      resource: replicaset
      selector: component=controller,app=metallb
      condition: --for=jsonpath='{.status.availableReplicas}'=1
  loop_control:
    label: "{{ item.description }}"
 - name: Test metallb-system webhook-service endpoint
  command: >-
    k3s kubectl -n metallb-system get endpoints webhook-service
  changed_when: false
  with_items: "{{ groups[group_name_master | default('master')] }}"
  run_once: true
 - name: Apply metallb CRs
  command: >-
    k3s kubectl apply -f /tmp/k3s/metallb-crs.yaml
    --timeout='{{ metal_lb_available_timeout }}'
  register: this
  changed_when: false
  run_once: true
  until: this.rc == 0
  retries: 5
 - name: Test metallb-system resources for Layer 2 configuration
  command: >-
    k3s kubectl -n metallb-system get {{ item }}
  changed_when: false
  run_once: true
  when: metal_lb_mode == "layer2"
  with_items:
    - IPAddressPool
    - L2Advertisement
 - name: Test metallb-system resources for BGP configuration
  command: >-
    k3s kubectl -n metallb-system get {{ item }}
  changed_when: false
  run_once: true
  when: metal_lb_mode == "bgp"
  with_items:
    - IPAddressPool
    - BGPPeer
    - BGPAdvertisement
--- a/roles/k3s_server_post/templates/metallb.crs.j2
+++ b/roles/k3s_server_post/templates/metallb.crs.j2
@@ -0,0 +1,43 @@
 apiVersion: metallb.io/v1beta1
 kind: IPAddressPool
 metadata:
  name: first-pool
  namespace: metallb-system
 spec:
  addresses:
 {% if metal_lb_ip_range is string %}
 {# metal_lb_ip_range was used in the legacy way: single string instead of a list #}
 {#   => transform to list with single element #}
 {% set metal_lb_ip_range = [metal_lb_ip_range] %}
 {% endif %}
 {% for range in metal_lb_ip_range %}
  - {{ range }}
 {% endfor %}
 {% if metal_lb_mode == "layer2" %}
 ---
 apiVersion: metallb.io/v1beta1
 kind: L2Advertisement
 metadata:
  name: default
  namespace: metallb-system
 {% endif %}
 {% if metal_lb_mode == "bgp" %}
 ---
 apiVersion: metallb.io/v1beta2
 kind: BGPPeer
 metadata:
  name: default
  namespace: metallb-system
 spec:
  myASN: {{ metal_lb_bgp_my_asn }}
  peerASN: {{ metal_lb_bgp_peer_asn }}
  peerAddress: {{ metal_lb_bgp_peer_address }}
 ---
 apiVersion: metallb.io/v1beta1
 kind: BGPAdvertisement
 metadata:
  name: default
  namespace: metallb-system
 {% endif %}
--- a/roles/lxc/handlers/main.yml
+++ b/roles/lxc/handlers/main.yml
@@ -0,0 +1,5 @@
 ---
 - name: Reboot server
  become: true
  reboot:
  listen: reboot server
--- a/roles/lxc/tasks/main.yml
+++ b/roles/lxc/tasks/main.yml
@@ -0,0 +1,21 @@
 ---
 - name: Check for rc.local file
  stat:
    path: /etc/rc.local
  register: rcfile
 - name: Create rc.local if needed
  lineinfile:
    path: /etc/rc.local
    line: "#!/bin/sh -e"
    create: true
    insertbefore: BOF
    mode: "u=rwx,g=rx,o=rx"
  when: not rcfile.stat.exists
 - name: Write rc.local file
  blockinfile:
    path: /etc/rc.local
    content: "{{ lookup('template', 'templates/rc.local.j2') }}"
    state: present
  notify: reboot server
--- a/roles/prereq/defaults/main.yml
+++ b/roles/prereq/defaults/main.yml
@@ -0,0 +1,4 @@
 ---
 secure_path:
  RedHat: '/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin'
  Suse: '/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin'
--- a/roles/prereq/tasks/main.yml
+++ b/roles/prereq/tasks/main.yml
@@ -1,27 +1,37 @@
 ---
 - name: Set same timezone on every Server
-  timezone:
+  community.general.timezone:
    name: "{{ system_timezone }}"
  when: (system_timezone is defined) and (system_timezone != "Your/Timezone")
 - name: Set SELinux to disabled state
-  selinux:
+  ansible.posix.selinux:
    state: disabled
  when: ansible_os_family == "RedHat"
 - name: Enable IPv4 forwarding
-  sysctl:
+  ansible.posix.sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
-    reload: yes
+    reload: true
  tags: sysctl
 - name: Enable IPv6 forwarding
-  sysctl:
+  ansible.posix.sysctl:
    name: net.ipv6.conf.all.forwarding
    value: "1"
    state: present
-    reload: yes
+    reload: true
  tags: sysctl
 - name: Enable IPv6 router advertisements
  ansible.posix.sysctl:
    name: net.ipv6.conf.all.accept_ra
    value: "2"
    state: present
    reload: true
  tags: sysctl
 - name: Add br_netfilter to /etc/modules-load.d/
  copy:
@@ -31,28 +41,29 @@
  when: ansible_os_family == "RedHat"
 - name: Load br_netfilter
-  modprobe:
+  community.general.modprobe:
    name: br_netfilter
    state: present
  when: ansible_os_family == "RedHat"
 - name: Set bridge-nf-call-iptables (just to be sure)
-  sysctl:
+  ansible.posix.sysctl:
    name: "{{ item }}"
    value: "1"
    state: present
-    reload: yes
+    reload: true
  when: ansible_os_family == "RedHat"
  loop:
    - net.bridge.bridge-nf-call-iptables
    - net.bridge.bridge-nf-call-ip6tables
  tags: sysctl
 - name: Add /usr/local/bin to sudo secure_path
  lineinfile:
-    line: 'Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin'
+    line: 'Defaults    secure_path = {{ secure_path[ansible_os_family] }}'
    regexp: "Defaults(\\s)*secure_path(\\s)*="
    state: present
    insertafter: EOF
    path: /etc/sudoers
    validate: 'visudo -cf %s'
-  when: ansible_os_family == "RedHat"
+  when: ansible_os_family in [ "RedHat", "Suse" ]
--- a/roles/proxmox_lxc/handlers/main.yml
+++ b/roles/proxmox_lxc/handlers/main.yml
@@ -0,0 +1,13 @@
 ---
 - name: Reboot containers
  block:
    - name: Get container ids from filtered files
      set_fact:
        proxmox_lxc_filtered_ids: >-
          {{ proxmox_lxc_filtered_files | map("split", "/") | map("last") | map("split", ".") | map("first") }}
      listen: reboot containers
    - name: Reboot container
      command: "pct reboot {{ item }}"
      loop: "{{ proxmox_lxc_filtered_ids }}"
      changed_when: true
      listen: reboot containers
--- a/roles/proxmox_lxc/tasks/main.yml
+++ b/roles/proxmox_lxc/tasks/main.yml
@@ -0,0 +1,44 @@
 ---
 - name: Check for container files that exist on this host
  stat:
    path: "/etc/pve/lxc/{{ item }}.conf"
  loop: "{{ proxmox_lxc_ct_ids }}"
  register: stat_results
 - name: Filter out files that do not exist
  set_fact:
    proxmox_lxc_filtered_files:
      '{{ stat_results.results | rejectattr("stat.exists", "false") | map(attribute="stat.path") }}'
 # https://gist.github.com/triangletodd/02f595cd4c0dc9aac5f7763ca2264185
 - name: Ensure lxc config has the right apparmor profile
  lineinfile:
    dest: "{{ item }}"
    regexp: "^lxc.apparmor.profile"
    line: "lxc.apparmor.profile: unconfined"
  loop: "{{ proxmox_lxc_filtered_files }}"
  notify: reboot containers
 - name: Ensure lxc config has the right cgroup
  lineinfile:
    dest: "{{ item }}"
    regexp: "^lxc.cgroup.devices.allow"
    line: "lxc.cgroup.devices.allow: a"
  loop: "{{ proxmox_lxc_filtered_files }}"
  notify: reboot containers
 - name: Ensure lxc config has the right cap drop
  lineinfile:
    dest: "{{ item }}"
    regexp: "^lxc.cap.drop"
    line: "lxc.cap.drop: "
  loop: "{{ proxmox_lxc_filtered_files }}"
  notify: reboot containers
 - name: Ensure lxc config has the right mounts
  lineinfile:
    dest: "{{ item }}"
    regexp: "^lxc.mount.auto"
    line: 'lxc.mount.auto: "proc:rw sys:rw"'
  loop: "{{ proxmox_lxc_filtered_files }}"
  notify: reboot containers
--- a/roles/raspberrypi/defaults/main.yml
+++ b/roles/raspberrypi/defaults/main.yml
@@ -0,0 +1,6 @@
 ---
 # Indicates whether the k3s prerequisites for Raspberry Pi should be set up
 # Possible values:
 #   - present
 #   - absent
 state: present
--- a/roles/raspberrypi/handlers/main.yml
+++ b/roles/raspberrypi/handlers/main.yml
@@ -1,3 +1,4 @@
 ---
- name: reboot
+- name: Reboot
  reboot:
  listen: reboot
--- a/roles/raspberrypi/tasks/main.yml
+++ b/roles/raspberrypi/tasks/main.yml
@@ -17,21 +17,19 @@
  when:
    grep_cpuinfo_raspberrypi.rc == 0 or grep_device_tree_model_raspberrypi.rc == 0
- name: Set detected_distribution to Raspbian
+- name: Set detected_distribution to Raspbian (ARM64 on Raspbian, Debian Buster/Bullseye/Bookworm)
  set_fact:
    detected_distribution: Raspbian
  when: >
    raspberry_pi|default(false) and
    ( ansible_facts.lsb.id|default("") == "Raspbian" or
      ansible_facts.lsb.description|default("") is match("[Rr]aspbian.*") )
 - name: Set detected_distribution to Raspbian (ARM64 on Debian Buster)
  set_fact:
    detected_distribution: Raspbian
  vars:
    allowed_descriptions:
      - "[Rr]aspbian.*"
      - "Debian.*buster"
      - "Debian.*bullseye"
      - "Debian.*bookworm"
  when:
    - ansible_facts.architecture is search("aarch64")
    - raspberry_pi|default(false)
-    - ansible_facts.lsb.description|default("") is match("Debian.*buster")
+    - ansible_facts.lsb.description|default("") is match(allowed_descriptions | join('|'))
 - name: Set detected_distribution_major_version
  set_fact:
@@ -39,21 +37,16 @@
  when:
    - detected_distribution | default("") == "Raspbian"
- name: Set detected_distribution to Raspbian (ARM64 on Debian Bullseye)
+- name: Execute OS related tasks on the Raspberry Pi - {{ action_ }}
  set_fact:
    detected_distribution: Raspbian
  when:
    - ansible_facts.architecture is search("aarch64")
    - raspberry_pi|default(false)
    - ansible_facts.lsb.description|default("") is match("Debian.*bullseye")
 - name: execute OS related tasks on the Raspberry Pi
  include_tasks: "{{ item }}"
  with_first_found:
-    - "prereq/{{ detected_distribution }}-{{ detected_distribution_major_version }}.yml"
+    - "{{ action_ }}/{{ detected_distribution }}-{{ detected_distribution_major_version }}.yml"
-    - "prereq/{{ detected_distribution }}.yml"
+    - "{{ action_ }}/{{ detected_distribution }}.yml"
-    - "prereq/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
+    - "{{ action_ }}/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"
-    - "prereq/{{ ansible_distribution }}.yml"
+    - "{{ action_ }}/{{ ansible_distribution }}.yml"
-    - "prereq/default.yml"
+    - "{{ action_ }}/default.yml"
  vars:
    action_: >-
      {% if state == "present" %}setup{% else %}teardown{% endif %}
  when:
    - raspberry_pi|default(false)
--- a/roles/raspberrypi/tasks/prereq/Raspbian.yml
+++ b/roles/raspberrypi/tasks/prereq/Raspbian.yml
@@ -8,21 +8,22 @@
  notify: reboot
 - name: Install iptables
-  apt: name=iptables state=present
+  apt:
    name: iptables
    state: present
 - name: Flush iptables before changing to iptables-legacy
  iptables:
    flush: true
  changed_when: false   # iptables flush always returns changed
 - name: Changing to iptables-legacy
-  alternatives:
+  community.general.alternatives:
    path: /usr/sbin/iptables-legacy
    name: iptables
  register: ip4_legacy
 - name: Changing to ip6tables-legacy
-  alternatives:
+  community.general.alternatives:
    path: /usr/sbin/ip6tables-legacy
    name: ip6tables
  register: ip6_legacy
--- a/roles/raspberrypi/tasks/prereq/CentOS.yml
+++ b/roles/raspberrypi/tasks/prereq/CentOS.yml
@@ -1,8 +1,9 @@
 ---
- name: Enable cgroup via boot commandline if not already enabled for Centos
+- name: Enable cgroup via boot commandline if not already enabled for Rocky
  lineinfile:
    path: /boot/cmdline.txt
-    backrefs: yes
+    backrefs: true
    regexp: '^((?!.*\bcgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory\b).*)$'
    line: '\1 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory'
  notify: reboot
  when: not ansible_check_mode
--- a/roles/raspberrypi/tasks/prereq/Ubuntu.yml
+++ b/roles/raspberrypi/tasks/prereq/Ubuntu.yml
@@ -2,7 +2,12 @@
 - name: Enable cgroup via boot commandline if not already enabled for Ubuntu on a Raspberry Pi
  lineinfile:
    path: /boot/firmware/cmdline.txt
-    backrefs: yes
+    backrefs: true
    regexp: '^((?!.*\bcgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory\b).*)$'
    line: '\1 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory'
  notify: reboot
 - name: Install linux-modules-extra-raspi
  apt:
    name: linux-modules-extra-raspi
    state: present
--- a/roles/raspberrypi/tasks/prereq/default.yml
+++ b/roles/raspberrypi/tasks/prereq/default.yml
--- a/roles/raspberrypi/tasks/teardown/Raspbian.yml
+++ b/roles/raspberrypi/tasks/teardown/Raspbian.yml
@@ -0,0 +1 @@
 ---
--- a/roles/raspberrypi/tasks/teardown/Rocky.yml
+++ b/roles/raspberrypi/tasks/teardown/Rocky.yml
@@ -0,0 +1 @@
 ---
--- a/roles/raspberrypi/tasks/teardown/Ubuntu.yml
+++ b/roles/raspberrypi/tasks/teardown/Ubuntu.yml
@@ -0,0 +1,5 @@
 ---
 - name: Remove linux-modules-extra-raspi
  apt:
    name: linux-modules-extra-raspi
    state: absent
--- a/roles/raspberrypi/tasks/teardown/default.yml
+++ b/roles/raspberrypi/tasks/teardown/default.yml
@@ -0,0 +1 @@
 ---
--- a/roles/reset/tasks/main.yml
+++ b/roles/reset/tasks/main.yml
@@ -3,14 +3,14 @@
  systemd:
    name: "{{ item }}"
    state: stopped
-    enabled: no
+    enabled: false
  failed_when: false
  with_items:
    - k3s
    - k3s-node
    - k3s-init
- name: pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
+- name: RUN pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
  register: pkill_containerd_shim_runc
  command: pkill -9 -f "k3s/data/[^/]+/bin/containerd-shim-runc"
  changed_when: "pkill_containerd_shim_runc.rc == 0"
@@ -44,13 +44,52 @@
    - /var/lib/kubelet
    - /var/lib/rancher/k3s
    - /var/lib/rancher/
    - /usr/local/bin/k3s
    - /var/lib/cni/
- name: daemon_reload
+- name: Remove K3s http_proxy files
-  systemd:
+  file:
-    daemon_reload: yes
+    name: "{{ item }}"
    state: absent
  with_items:
    - "{{ systemd_dir }}/k3s.service.d/http_proxy.conf"
    - "{{ systemd_dir }}/k3s.service.d"
    - "{{ systemd_dir }}/k3s-node.service.d/http_proxy.conf"
    - "{{ systemd_dir }}/k3s-node.service.d"
  when: proxy_env is defined
- name: Reboot and wait for node to come back up
+- name: Reload daemon_reload
-  reboot:
+  systemd:
-    reboot_timeout: 3600
+    daemon_reload: true
 - name: Remove tmp directory used for manifests
  file:
    path: /tmp/k3s
    state: absent
 - name: Check if rc.local exists
  stat:
    path: /etc/rc.local
  register: rcfile
 - name: Remove rc.local modifications for proxmox lxc containers
  become: true
  blockinfile:
    path: /etc/rc.local
    content: "{{ lookup('template', 'templates/rc.local.j2') }}"
    create: false
    state: absent
  when: proxmox_lxc_configure and rcfile.stat.exists
 - name: Check rc.local for cleanup
  become: true
  slurp:
    src: /etc/rc.local
  register: rcslurp
  when: proxmox_lxc_configure and rcfile.stat.exists
 - name: Cleanup rc.local if we only have a Shebang line
  become: true
  file:
    path: /etc/rc.local
    state: absent
  when: proxmox_lxc_configure and rcfile.stat.exists and ((rcslurp.content | b64decode).splitlines() | length) <= 1
--- a/roles/reset/tasks/umount_with_children.yml
+++ b/roles/reset/tasks/umount_with_children.yml
@@ -9,7 +9,7 @@
  check_mode: false
 - name: Umount filesystem
-  mount:
+  ansible.posix.mount:
    path: "{{ item }}"
    state: unmounted
  with_items:
--- a/Show More
+++ b/Show More
		`@@ -0,0 +1,2 @@`
							`[defaults]`
							`inventory = inventory/my-cluster/hosts.ini ; Adapt this to the path to your inventory file`
`@@ -1,3 +1,3 @@`
	`#!/bin/bash`	`#!/bin/bash`

	`ansible-playbook site.yml -i inventory/my-cluster/hosts.ini`	`ansible-playbook site.yml`
		`@@ -0,0 +1,2 @@`
							`---`
							`ansible_user: '{{ proxmox_lxc_ssh_user }}'`