feat(k3s): Updated to v1.27.4+k3s1

.ansible-lint

@@ -13,8 +13,5 @@ exclude_paths:
   - 'molecule/**/prepare.yml'
   - 'molecule/**/reset.yml'
 
-  # The file was generated by galaxy ansible - don't mess with it.
-  - 'galaxy.yml'
-
 skip_list:
   - 'fqcn-builtins'

.github/workflows/cache.yml

@@ -1,42 +0,0 @@
----
-name: "Cache"
-on:
-  workflow_call:
-jobs:
-  molecule:
-    name: cache
-    runs-on: self-hosted
-    env:
-      PYTHON_VERSION: "3.11"
-
-    steps:
-      - name: Check out the codebase
-        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-          cache: 'pip' # caching pip dependencies
-
-      - name: Cache Vagrant boxes
-        id: cache-vagrant
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
-        with:
-          lookup-only: true #if it exists, we don't need to restore and can skip the next step
-          path: |
-            ~/.vagrant.d/boxes
-          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
-          restore-keys: |
-            vagrant-boxes
-
-      - name: Download Vagrant boxes for all scenarios
-        # To save some cache space, all scenarios share the same cache key.
-        # On the other hand, this means that the cache contents should be
-        # the same across all scenarios. This step ensures that.
-        if: steps.cache-vagrant.outputs.cache-hit != 'true' # only run if false since this is just a cache step
-        run: |
-          ./.github/download-boxes.sh
-          vagrant box list

.github/workflows/ci.yml

@@ -8,11 +8,8 @@ on:
     paths-ignore:
       - '**/README.md'
 jobs:
-  pre:
-    uses: ./.github/workflows/cache.yml
   lint:
     uses: ./.github/workflows/lint.yml
-    needs: [pre]
   test:
     uses: ./.github/workflows/test.yml
-    needs: [pre, lint]
+    needs: [lint]

.github/workflows/lint.yml

@@ -5,7 +5,7 @@ on:
 jobs:
   pre-commit-ci:
     name: Pre-Commit
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     env:
       PYTHON_VERSION: "3.11"
 
@@ -21,11 +21,21 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip' # caching pip dependencies
 
-      - name: Restore Ansible cache
-        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Ansible
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
         with:
           path: ~/.ansible/collections
-          key: ansible-${{ hashFiles('collections/requirements.yml') }}
+          key: ${{ runner.os }}-ansible-${{ hashFiles('collections/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-ansible-
 
       - name: Install dependencies
         run: |
@@ -37,12 +47,16 @@ jobs:
           python3 -m pip install -r requirements.txt
           echo "::endgroup::"
 
+          echo "::group::Install Ansible role requirements from collections/requirements.yml"
+          ansible-galaxy install -r collections/requirements.yml
+          echo "::endgroup::"
+
       - name: Run pre-commit
         uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # 3.0.0
 
   ensure-pinned-actions:
     name: Ensure SHA Pinned Actions
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v3 2.5.0

.github/workflows/test.yml

@@ -5,7 +5,7 @@ on:
 jobs:
   molecule:
     name: Molecule
-    runs-on: self-hosted
+    runs-on: macos-12
     strategy:
       matrix:
         scenario:
@@ -30,19 +30,35 @@ jobs:
           * fdad:bad:ba55::/64
           EOF
 
+      - name: Cache pip
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('./requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Cache Vagrant boxes
+        uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # 3.0.11
+        with:
+          path: |
+            ~/.vagrant.d/boxes
+          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
+          restore-keys: |
+            vagrant-boxes
+
+      - name: Download Vagrant boxes for all scenarios
+        # To save some cache space, all scenarios share the same cache key.
+        # On the other hand, this means that the cache contents should be
+        # the same across all scenarios. This step ensures that.
+        run: ./.github/download-boxes.sh
+
       - name: Set up Python ${{ env.PYTHON_VERSION }}
         uses: actions/setup-python@75f3110429a8c05be0e1bf360334e4cced2b63fa # 2.3.3
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip' # caching pip dependencies
 
-      - name: Restore vagrant Boxes cache
-        uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # 4.0
-        with:
-          path: ~/.vagrant.d/boxes
-          key: vagrant-boxes-${{ hashFiles('**/molecule.yml') }}
-          fail-on-cache-miss: true
-
       - name: Install dependencies
         run: |
           echo "::group::Upgrade pip"
@@ -59,7 +75,7 @@ jobs:
         env:
           ANSIBLE_K3S_LOG_DIR: ${{ runner.temp }}/logs/k3s-ansible/${{ matrix.scenario }}
           ANSIBLE_SSH_RETRIES: 4
-          ANSIBLE_TIMEOUT: 120
+          ANSIBLE_TIMEOUT: 60
           PY_COLORS: 1
           ANSIBLE_FORCE_COLOR: 1
 

.yamllint

@@ -6,6 +6,4 @@ rules:
     max: 120
     level: warning
   truthy:
-    allowed-values: ['true', 'false']
-ignore:
-  - galaxy.yml
+    allowed-values: ['true', 'false', 'yes', 'no']

README.md

@@ -4,7 +4,7 @@
 
 This playbook will build an HA Kubernetes cluster with `k3s`, `kube-vip` and MetalLB via `ansible`.
 
-This is based on the work from [this fork](https://github.com/212850a/k3s-ansible) which is based on the work from [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible). It uses [kube-vip](https://kube-vip.io/) to create a load balancer for control plane, and [metal-lb](https://metallb.universe.tf/installation/) for its service `LoadBalancer`.
+This is based on the work from [this fork](https://github.com/212850a/k3s-ansible) which is based on the work from [k3s-io/k3s-ansible](https://github.com/k3s-io/k3s-ansible). It uses [kube-vip](https://kube-vip.chipzoller.dev/) to create a load balancer for control plane, and [metal-lb](https://metallb.universe.tf/installation/) for its service `LoadBalancer`.
 
 If you want more context on how this works, see:
 
@@ -118,28 +118,6 @@ You can find more information about it [here](molecule/README.md).
 
 This repo uses `pre-commit` and `pre-commit-hooks` to lint and fix common style and syntax errors.  Be sure to install python packages and then run `pre-commit install`.  For more information, see [pre-commit](https://pre-commit.com/)
 
-## 🌌 Ansible Galaxy
-
-This collection can now be used in larger ansible projects.
-
-Instructions:
-
-- create or modify a file `collections/requirements.yml` in your project
-
-```yml
-collections:
-  - name: ansible.utils
-  - name: community.general
-  - name: ansible.posix
-  - name: kubernetes.core
-  - name: https://github.com/techno-tim/k3s-ansible.git
-    type: git
-    version: master
-```
-
-- install via `ansible-galaxy collection install -r ./collections/requirements.yml`
-- every role is now available via the prefix `techno_tim.k3s_ansible.` e.g. `techno_tim.k3s_ansible.lxc`
-
 ## Thanks 🤝
 
 This repo is really standing on the shoulders of giants. Thank you to all those who have contributed and thanks to these repos for code and ideas:

galaxy.yml

@@ -1,81 +0,0 @@
-### REQUIRED
-# The namespace of the collection. This can be a company/brand/organization or product namespace under which all
-# content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
-# underscores or numbers and cannot contain consecutive underscores
-namespace: techno_tim
-
-# The name of the collection. Has the same character restrictions as 'namespace'
-name: k3s_ansible
-
-# The version of the collection. Must be compatible with semantic versioning
-version: 1.0.0
-
-# The path to the Markdown (.md) readme file. This path is relative to the root of the collection
-readme: README.md
-
-# A list of the collection's content authors. Can be just the name or in the format 'Full Name <email> (url)
-# @nicks:irc/im.site#channel'
-authors:
-- your name <example@domain.com>
-
-
-### OPTIONAL but strongly recommended
-# A short summary description of the collection
-description: >
-  The easiest way to bootstrap a self-hosted High Availability Kubernetes
-  cluster. A fully automated HA k3s etcd install with kube-vip, MetalLB,
-  and more.
-
-# Either a single license or a list of licenses for content inside of a collection. Ansible Galaxy currently only
-# accepts L(SPDX,https://spdx.org/licenses/) licenses. This key is mutually exclusive with 'license_file'
-license:
-- Apache-2.0
-
-
-# A list of tags you want to associate with the collection for indexing/searching. A tag name has the same character
-# requirements as 'namespace' and 'name'
-tags:
-  - etcd
-  - high-availability
-  - k8s
-  - k3s
-  - k3s-cluster
-  - kube-vip
-  - kubernetes
-  - metallb
-  - rancher
-
-# Collections that this collection requires to be installed for it to be usable. The key of the dict is the
-# collection label 'namespace.name'. The value is a version range
-# L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
-# range specifiers can be set and are separated by ','
-dependencies:
-  ansible.utils: '*'
-  ansible.posix: '*'
-  community.general: '*'
-  kubernetes.core: '*'
-
-# The URL of the originating SCM repository
-repository: https://github.com/techno-tim/k3s-ansible
-
-# The URL to any online docs
-documentation: https://github.com/techno-tim/k3s-ansible
-
-# The URL to the homepage of the collection/project
-homepage: https://www.youtube.com/watch?v=CbkEWcUZ7zM
-
-# The URL to the collection issue tracker
-issues: https://github.com/techno-tim/k3s-ansible/issues
-
-# A list of file glob-like patterns used to filter any files or directories that should not be included in the build
-# artifact. A pattern is matched from the relative path of the file or directory of the collection directory. This
-# uses 'fnmatch' to match the files or directories. Some directories and files like 'galaxy.yml', '*.pyc', '*.retry',
-# and '.git' are always filtered. Mutually exclusive with 'manifest'
-build_ignore: []
-
-# A dict controlling use of manifest directives used in building the collection artifact. The key 'directives' is a
-# list of MANIFEST.in style
-# L(directives,https://packaging.python.org/en/latest/guides/using-manifest-in/#manifest-in-commands). The key
-# 'omit_default_directives' is a boolean that controls whether the default directives are used. Mutually exclusive
-# with 'build_ignore'
-# manifest: null

inventory/sample/group_vars/all.yml

@@ -1,5 +1,5 @@
 ---
-k3s_version: v1.26.12+k3s1
+k3s_version: v1.27.4+k3s1
 # this is the user that has ssh access to these machines
 ansible_user: ansibleuser
 systemd_dir: /etc/systemd/system
@@ -66,9 +66,9 @@ metal_lb_ip_range: "192.168.30.80-192.168.30.90"
 # Please read https://gist.github.com/triangletodd/02f595cd4c0dc9aac5f7763ca2264185 before using this.
 # Most notably, your containers must be privileged, and must not have nesting set to true.
 # Please note this script disables most of the security of lxc containers, with the trade off being that lxc
-# containers are significantly more resource efficient compared to full VMs.
+# containers are significantly more resource efficent compared to full VMs.
 # Mixing and matching VMs and lxc containers is not supported, ymmv if you want to do this.
-# I would only really recommend using this if you have particularly low powered proxmox nodes where the overhead of
+# I would only really recommend using this if you have partiularly low powered proxmox nodes where the overhead of
 # VMs would use a significant portion of your available resources.
 proxmox_lxc_configure: false
 # the user that you would use to ssh into the host, for example if you run ssh some-user@my-proxmox-host,
@@ -81,49 +81,3 @@ proxmox_lxc_ct_ids:
   - 202
   - 203
   - 204
-
-# Only enable this if you have set up your own container registry to act as a mirror / pull-through cache
-# (harbor / nexus / docker's official registry / etc).
-# Can be beneficial for larger dev/test environments (for example if you're getting rate limited by docker hub),
-# or air-gapped environments where your nodes don't have internet access after the initial setup
-# (which is still needed for downloading the k3s binary and such).
-# k3s's documentation about private registries here: https://docs.k3s.io/installation/private-registry
-custom_registries: false
-# The registries can be authenticated or anonymous, depending on your registry server configuration.
-# If they allow anonymous access, simply remove the following bit from custom_registries_yaml
-#   configs:
-#     "registry.domain.com":
-#       auth:
-#         username: yourusername
-#         password: yourpassword
-# The following is an example that pulls all images used in this playbook through your private registries.
-# It also allows you to pull your own images from your private registry, without having to use imagePullSecrets
-# in your deployments.
-# If all you need is your own images and you don't care about caching the docker/quay/ghcr.io images,
-# you can just remove those from the mirrors: section.
-custom_registries_yaml: |
-  mirrors:
-    docker.io:
-      endpoint:
-        - "https://registry.domain.com/v2/dockerhub"
-    quay.io:
-      endpoint:
-        - "https://registry.domain.com/v2/quayio"
-    ghcr.io:
-      endpoint:
-        - "https://registry.domain.com/v2/ghcrio"
-    registry.domain.com:
-      endpoint:
-        - "https://registry.domain.com"
-
-  configs:
-    "registry.domain.com":
-      auth:
-        username: yourusername
-        password: yourpassword
-
-# Only enable and configure these if you access the internet through a proxy
-# proxy_env:
-#   HTTP_PROXY: "http://proxy.domain.local:3128"
-#   HTTPS_PROXY: "http://proxy.domain.local:3128"
-#   NO_PROXY: "*.domain.local,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"

molecule/default/molecule.yml

@@ -7,7 +7,7 @@ platforms:
 
   - name: control1
     box: generic/ubuntu2204
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -23,7 +23,7 @@ platforms:
 
   - name: control2
     box: generic/debian11
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -34,7 +34,7 @@ platforms:
 
   - name: control3
     box: generic/rocky9
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -45,7 +45,7 @@ platforms:
 
   - name: node1
     box: generic/ubuntu2204
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -61,7 +61,7 @@ platforms:
 
   - name: node2
     box: generic/rocky9
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -72,8 +72,6 @@ platforms:
 
 provisioner:
   name: ansible
-  env:
-    ANSIBLE_VERBOSITY: 1
   playbooks:
     converge: ../resources/converge.yml
     side_effect: ../resources/reset.yml
@@ -84,6 +82,7 @@ provisioner:
 scenario:
   test_sequence:
     - dependency
+    - lint
     - cleanup
     - destroy
     - syntax

molecule/default/prepare.yml

@@ -17,6 +17,6 @@
       # and security needs.
       ansible.builtin.systemd:
         name: firewalld
-        enabled: false
+        enabled: no
         state: stopped
       become: true

molecule/ipv6/molecule.yml

@@ -6,7 +6,7 @@ driver:
 platforms:
   - name: control1
     box: generic/ubuntu2204
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -22,7 +22,7 @@ platforms:
 
   - name: control2
     box: generic/ubuntu2204
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -38,7 +38,7 @@ platforms:
 
   - name: node1
     box: generic/ubuntu2204
-    memory: 1024
+    memory: 2048
     cpus: 2
     groups:
       - k3s_cluster
@@ -53,8 +53,6 @@ platforms:
       ssh.password: "vagrant"
 provisioner:
   name: ansible
-  env:
-    ANSIBLE_VERBOSITY: 1
   playbooks:
     converge: ../resources/converge.yml
     side_effect: ../resources/reset.yml
@@ -65,6 +63,7 @@ provisioner:
 scenario:
   test_sequence:
     - dependency
+    - lint
     - cleanup
     - destroy
     - syntax

molecule/resources/verify_from_outside/tasks/test/deploy-example.yml

@@ -35,7 +35,7 @@
     - name: Assert that the nginx welcome page is available
       ansible.builtin.uri:
         url: http://{{ ip | ansible.utils.ipwrap }}:{{ port_ }}/
-        return_content: true
+        return_content: yes
       register: result
       failed_when: "'Welcome to nginx!' not in result.content"
       vars:

molecule/single_node/molecule.yml

@@ -21,8 +21,6 @@ platforms:
         ip: 192.168.30.50
 provisioner:
   name: ansible
-  env:
-    ANSIBLE_VERBOSITY: 1
   playbooks:
     converge: ../resources/converge.yml
     side_effect: ../resources/reset.yml
@@ -33,6 +31,7 @@ provisioner:
 scenario:
   test_sequence:
     - dependency
+    - lint
     - cleanup
     - destroy
     - syntax

reboot.yml

@@ -1,7 +1,7 @@
 ---
 - name: Reboot k3s_cluster
   hosts: k3s_cluster
-  gather_facts: true
+  gather_facts: yes
   tasks:
     - name: Reboot the nodes (and Wait upto 5 mins max)
       become: true

requirements.in

@@ -1,10 +1,10 @@
-ansible-core>=2.16.2
+ansible-core>=2.13.5
 jmespath>=1.0.1
-jsonpatch>=1.33
-kubernetes>=29.0.0
-molecule-plugins[vagrant]
-molecule>=6.0.3
-netaddr>=0.10.1
-pre-commit>=3.6.0
-pre-commit-hooks>=4.5.0
-pyyaml>=6.0.1
+jsonpatch>=1.32
+kubernetes>=25.3.0
+molecule-vagrant>=1.0.0
+molecule>=4.0.3
+netaddr>=0.8.0
+pre-commit>=2.20.0
+pre-commit-hooks>=1.3.1
+pyyaml>=6.0

requirements.txt

@@ -4,165 +4,174 @@
 #
 #    pip-compile requirements.in
 #
-ansible-compat==4.1.11
+ansible-compat==3.0.1
     # via molecule
-ansible-core==2.16.2
+ansible-core==2.15.2
     # via
     #   -r requirements.in
     #   ansible-compat
-    #   molecule
-attrs==23.2.0
-    # via
-    #   jsonschema
-    #   referencing
-bracex==2.4
-    # via wcmatch
-cachetools==5.3.2
+arrow==1.2.3
+    # via jinja2-time
+attrs==22.1.0
+    # via jsonschema
+binaryornot==0.4.4
+    # via cookiecutter
+cachetools==5.2.0
     # via google-auth
-certifi==2023.11.17
+certifi==2022.9.24
     # via
     #   kubernetes
     #   requests
-cffi==1.16.0
+cffi==1.15.1
     # via cryptography
-cfgv==3.4.0
+cfgv==3.3.1
     # via pre-commit
-charset-normalizer==3.3.2
+chardet==5.0.0
+    # via binaryornot
+charset-normalizer==2.1.1
     # via requests
-click==8.1.7
+click==8.1.3
     # via
     #   click-help-colors
+    #   cookiecutter
     #   molecule
-click-help-colors==0.9.4
+click-help-colors==0.9.1
     # via molecule
-cryptography==41.0.7
+commonmark==0.9.1
+    # via rich
+cookiecutter==2.1.1
+    # via molecule
+cryptography==38.0.3
     # via ansible-core
-distlib==0.3.8
+distlib==0.3.6
     # via virtualenv
+distro==1.8.0
+    # via selinux
 enrich==1.2.7
     # via molecule
-filelock==3.13.1
+filelock==3.8.0
     # via virtualenv
-google-auth==2.26.2
+google-auth==2.14.0
     # via kubernetes
-identify==2.5.33
+identify==2.5.8
     # via pre-commit
-idna==3.6
+idna==3.4
     # via requests
-jinja2==3.1.3
+jinja2==3.1.2
     # via
     #   ansible-core
+    #   cookiecutter
+    #   jinja2-time
     #   molecule
+    #   molecule-vagrant
+jinja2-time==0.2.0
+    # via cookiecutter
 jmespath==1.0.1
     # via -r requirements.in
 jsonpatch==1.33
     # via -r requirements.in
-jsonpointer==2.4
+jsonpointer==2.3
     # via jsonpatch
-jsonschema==4.21.1
+jsonschema==4.17.0
     # via
     #   ansible-compat
     #   molecule
-jsonschema-specifications==2023.12.1
-    # via jsonschema
-kubernetes==29.0.0
+kubernetes==25.3.0
     # via -r requirements.in
-markdown-it-py==3.0.0
-    # via rich
-markupsafe==2.1.4
+markupsafe==2.1.1
     # via jinja2
-mdurl==0.1.2
-    # via markdown-it-py
-molecule==6.0.3
+molecule==4.0.4
     # via
     #   -r requirements.in
-    #   molecule-plugins
-molecule-plugins[vagrant]==23.5.0
+    #   molecule-vagrant
+molecule-vagrant==1.0.0
     # via -r requirements.in
-netaddr==0.10.1
+netaddr==0.8.0
     # via -r requirements.in
-nodeenv==1.8.0
+nodeenv==1.7.0
     # via pre-commit
 oauthlib==3.2.2
-    # via
-    #   kubernetes
-    #   requests-oauthlib
-packaging==23.2
+    # via requests-oauthlib
+packaging==21.3
     # via
     #   ansible-compat
     #   ansible-core
     #   molecule
-platformdirs==4.1.0
+platformdirs==2.5.2
     # via virtualenv
-pluggy==1.3.0
+pluggy==1.0.0
     # via molecule
-pre-commit==3.6.0
+pre-commit==2.21.0
     # via -r requirements.in
-pre-commit-hooks==4.5.0
+pre-commit-hooks==4.4.0
     # via -r requirements.in
-pyasn1==0.5.1
+pyasn1==0.4.8
     # via
     #   pyasn1-modules
     #   rsa
-pyasn1-modules==0.3.0
+pyasn1-modules==0.2.8
     # via google-auth
 pycparser==2.21
     # via cffi
-pygments==2.17.2
+pygments==2.13.0
     # via rich
+pyparsing==3.0.9
+    # via packaging
+pyrsistent==0.19.2
+    # via jsonschema
 python-dateutil==2.8.2
-    # via kubernetes
+    # via
+    #   arrow
+    #   kubernetes
+python-slugify==6.1.2
+    # via cookiecutter
 python-vagrant==1.0.0
-    # via molecule-plugins
+    # via molecule-vagrant
 pyyaml==6.0.1
     # via
     #   -r requirements.in
     #   ansible-compat
     #   ansible-core
+    #   cookiecutter
     #   kubernetes
     #   molecule
+    #   molecule-vagrant
     #   pre-commit
-referencing==0.32.1
-    # via
-    #   jsonschema
-    #   jsonschema-specifications
-requests==2.31.0
+requests==2.28.1
     # via
+    #   cookiecutter
     #   kubernetes
     #   requests-oauthlib
 requests-oauthlib==1.3.1
     # via kubernetes
-resolvelib==1.0.1
+resolvelib==0.8.1
     # via ansible-core
-rich==13.7.0
+rich==12.6.0
     # via
     #   enrich
     #   molecule
-rpds-py==0.17.1
-    # via
-    #   jsonschema
-    #   referencing
 rsa==4.9
     # via google-auth
-ruamel-yaml==0.18.5
+ruamel-yaml==0.17.21
     # via pre-commit-hooks
-ruamel-yaml-clib==0.2.8
-    # via ruamel-yaml
+selinux==0.2.1
+    # via molecule-vagrant
 six==1.16.0
     # via
+    #   google-auth
     #   kubernetes
     #   python-dateutil
 subprocess-tee==0.4.1
     # via ansible-compat
-urllib3==2.1.0
+text-unidecode==1.3
+    # via python-slugify
+urllib3==1.26.12
     # via
     #   kubernetes
     #   requests
-virtualenv==20.25.0
+virtualenv==20.16.6
     # via pre-commit
-wcmatch==8.5
-    # via molecule
-websocket-client==1.7.0
+websocket-client==1.4.2
     # via kubernetes
 
 # The following packages are considered to be unsafe in a requirements file:

reset.yml

@@ -1,7 +1,7 @@
 ---
 - name: Reset k3s cluster
   hosts: k3s_cluster
-  gather_facts: true
+  gather_facts: yes
   roles:
     - role: reset
       become: true
@@ -17,7 +17,7 @@
 - name: Revert changes to Proxmox cluster
   hosts: proxmox
   gather_facts: true
-  become: true
+  become: yes
   remote_user: "{{ proxmox_lxc_ssh_user }}"
   roles:
     - role: reset_proxmox_lxc

roles/k3s_agent/tasks/http_proxy.yml

@@ -1,18 +0,0 @@
----
-
-- name: Create k3s-node.service.d directory
-  file:
-    path: '{{ systemd_dir }}/k3s-node.service.d'
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-
-
-- name: Copy K3s http_proxy conf file
-  template:
-    src: "http_proxy.conf.j2"
-    dest: "{{ systemd_dir }}/k3s-node.service.d/http_proxy.conf"
-    owner: root
-    group: root
-    mode: '0755'

roles/k3s_agent/tasks/main.yml

@@ -1,9 +1,5 @@
 ---
 
-- name: Deploy K3s http_proxy conf
-  include_tasks: http_proxy.yml
-  when: proxy_env is defined
-
 - name: Copy K3s service file
   template:
     src: "k3s.service.j2"
@@ -15,6 +11,6 @@
 - name: Enable and check K3s service
   systemd:
     name: k3s-node
-    daemon_reload: true
+    daemon_reload: yes
     state: restarted
-    enabled: true
+    enabled: yes

roles/k3s_agent/templates/http_proxy.conf.j2

@@ -1,4 +0,0 @@
-[Service]
-Environment=HTTP_PROXY={{ proxy_env.HTTP_PROXY }}
-Environment=HTTPS_PROXY={{ proxy_env.HTTPS_PROXY }}
-Environment=NO_PROXY={{ proxy_env.NO_PROXY }}

roles/k3s_custom_registries/defaults/main.yml

@@ -1,6 +0,0 @@
----
-# Indicates whether custom registries for k3s should be configured
-# Possible values:
-#   - present
-#   - absent
-state: present

roles/k3s_custom_registries/tasks/main.yml

@@ -1,17 +0,0 @@
----
-
-- name: Create directory /etc/rancher/k3s
-  file:
-    path: "/etc/{{ item }}"
-    state: directory
-    mode: '0755'
-  loop:
-    - rancher
-    - rancher/k3s
-
-- name: Insert registries into /etc/rancher/k3s/registries.yaml
-  blockinfile:
-    path: /etc/rancher/k3s/registries.yaml
-    block: "{{ custom_registries_yaml }}"
-    mode: '0600'
-    create: true

roles/k3s_server/tasks/http_proxy.yml

@@ -1,18 +0,0 @@
----
-
-- name: Create k3s.service.d directory
-  file:
-    path: '{{ systemd_dir }}/k3s.service.d'
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-
-
-- name: Copy K3s http_proxy conf file
-  template:
-    src: "http_proxy.conf.j2"
-    dest: "{{ systemd_dir }}/k3s.service.d/http_proxy.conf"
-    owner: root
-    group: root
-    mode: '0755'

roles/k3s_server/tasks/main.yml

@@ -6,29 +6,17 @@
     state: stopped
   failed_when: false
 
-# k3s-init won't work if the port is already in use
-- name: Stop k3s
-  systemd:
-    name: k3s
-    state: stopped
-  failed_when: false
-
 - name: Clean previous runs of k3s-init  # noqa command-instead-of-module
   # The systemd module does not support "reset-failed", so we need to resort to command.
   command: systemctl reset-failed k3s-init
   failed_when: false
   changed_when: false
 
-- name: Deploy K3s http_proxy conf
-  include_tasks: http_proxy.yml
-  when: proxy_env is defined
-
 - name: Deploy vip manifest
   include_tasks: vip.yml
 
 - name: Deploy metallb manifest
   include_tasks: metallb.yml
-  tags: metallb
 
 - name: Init cluster inside the transient k3s-init service
   command:
@@ -36,7 +24,7 @@
                       -p Restart=on-failure \
                       --unit=k3s-init \
                       k3s server {{ server_init_args }}"
-    creates: "{{ systemd_dir }}/k3s-init.service"
+    creates: "{{ systemd_dir }}/k3s.service"
 
 - name: Verification
   when: not ansible_check_mode
@@ -74,9 +62,9 @@
 - name: Enable and check K3s service
   systemd:
     name: k3s
-    daemon_reload: true
+    daemon_reload: yes
     state: restarted
-    enabled: true
+    enabled: yes
 
 - name: Wait for node-token
   wait_for:
@@ -117,7 +105,7 @@
   copy:
     src: /etc/rancher/k3s/k3s.yaml
     dest: "{{ ansible_user_dir }}/.kube/config"
-    remote_src: true
+    remote_src: yes
     owner: "{{ ansible_user_id }}"
     mode: "u=rw,g=,o="
 

roles/k3s_server/templates/http_proxy.conf.j2

@@ -1,4 +0,0 @@
-[Service]
-Environment=HTTP_PROXY={{ proxy_env.HTTP_PROXY }}
-Environment=HTTPS_PROXY={{ proxy_env.HTTPS_PROXY }}
-Environment=NO_PROXY={{ proxy_env.NO_PROXY }}

roles/k3s_server_post/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 # Timeout to wait for MetalLB services to come up
-metal_lb_available_timeout: 240s
+metal_lb_available_timeout: 120s
 
 # Name of the master group
 group_name_master: master

roles/k3s_server_post/tasks/main.yml

@@ -1,7 +1,6 @@
 ---
 - name: Deploy metallb pool
   include_tasks: metallb.yml
-  tags: metallb
 
 - name: Remove tmp directory used for manifests
   file:

roles/lxc/handlers/main.yml

@@ -2,4 +2,3 @@
 - name: Reboot server
   become: true
   reboot:
-  listen: reboot server

roles/prereq/defaults/main.yml

@@ -1,4 +0,0 @@
----
-secure_path:
-  RedHat: '/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin'
-  Suse: '/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin'

roles/prereq/tasks/main.yml

@@ -14,24 +14,21 @@
     name: net.ipv4.ip_forward
     value: "1"
     state: present
-    reload: true
-  tags: sysctl
+    reload: yes
 
 - name: Enable IPv6 forwarding
   ansible.posix.sysctl:
     name: net.ipv6.conf.all.forwarding
     value: "1"
     state: present
-    reload: true
-  tags: sysctl
+    reload: yes
 
 - name: Enable IPv6 router advertisements
   ansible.posix.sysctl:
     name: net.ipv6.conf.all.accept_ra
     value: "2"
     state: present
-    reload: true
-  tags: sysctl
+    reload: yes
 
 - name: Add br_netfilter to /etc/modules-load.d/
   copy:
@@ -51,19 +48,18 @@
     name: "{{ item }}"
     value: "1"
     state: present
-    reload: true
+    reload: yes
   when: ansible_os_family == "RedHat"
   loop:
     - net.bridge.bridge-nf-call-iptables
     - net.bridge.bridge-nf-call-ip6tables
-  tags: sysctl
 
 - name: Add /usr/local/bin to sudo secure_path
   lineinfile:
-    line: 'Defaults    secure_path = {{ secure_path[ansible_os_family] }}'
+    line: 'Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin'
     regexp: "Defaults(\\s)*secure_path(\\s)*="
     state: present
     insertafter: EOF
     path: /etc/sudoers
     validate: 'visudo -cf %s'
-  when: ansible_os_family in [ "RedHat", "Suse" ]
+  when: ansible_os_family == "RedHat"

roles/proxmox_lxc/handlers/main.yml

@@ -5,9 +5,7 @@
       set_fact:
         proxmox_lxc_filtered_ids: >-
           {{ proxmox_lxc_filtered_files | map("split", "/") | map("last") | map("split", ".") | map("first") }}
-      listen: reboot containers
     - name: Reboot container
       command: "pct reboot {{ item }}"
       loop: "{{ proxmox_lxc_filtered_ids }}"
       changed_when: true
-      listen: reboot containers

roles/raspberrypi/handlers/main.yml

@@ -1,4 +1,3 @@
 ---
 - name: Reboot
   reboot:
-  listen: reboot

roles/raspberrypi/tasks/main.yml

@@ -17,19 +17,21 @@
   when:
     grep_cpuinfo_raspberrypi.rc == 0 or grep_device_tree_model_raspberrypi.rc == 0
 
-- name: Set detected_distribution to Raspbian (ARM64 on Raspbian, Debian Buster/Bullseye/Bookworm)
+- name: Set detected_distribution to Raspbian
+  set_fact:
+    detected_distribution: Raspbian
+  when: >
+    raspberry_pi|default(false) and
+    ( ansible_facts.lsb.id|default("") == "Raspbian" or
+      ansible_facts.lsb.description|default("") is match("[Rr]aspbian.*") )
+
+- name: Set detected_distribution to Raspbian (ARM64 on Debian Buster)
   set_fact:
     detected_distribution: Raspbian
-  vars:
-    allowed_descriptions:
-      - "[Rr]aspbian.*"
-      - "Debian.*buster"
-      - "Debian.*bullseye"
-      - "Debian.*bookworm"
   when:
     - ansible_facts.architecture is search("aarch64")
     - raspberry_pi|default(false)
-    - ansible_facts.lsb.description|default("") is match(allowed_descriptions | join('|'))
+    - ansible_facts.lsb.description|default("") is match("Debian.*buster")
 
 - name: Set detected_distribution_major_version
   set_fact:
@@ -37,6 +39,14 @@
   when:
     - detected_distribution | default("") == "Raspbian"
 
+- name: Set detected_distribution to Raspbian (ARM64 on Debian Bullseye)
+  set_fact:
+    detected_distribution: Raspbian
+  when:
+    - ansible_facts.architecture is search("aarch64")
+    - raspberry_pi|default(false)
+    - ansible_facts.lsb.description|default("") is match("Debian.*bullseye")
+
 - name: Execute OS related tasks on the Raspberry Pi - {{ action_ }}
   include_tasks: "{{ item }}"
   with_first_found:

roles/raspberrypi/tasks/setup/Rocky.yml

@@ -2,7 +2,7 @@
 - name: Enable cgroup via boot commandline if not already enabled for Rocky
   lineinfile:
     path: /boot/cmdline.txt
-    backrefs: true
+    backrefs: yes
     regexp: '^((?!.*\bcgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory\b).*)$'
     line: '\1 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory'
   notify: reboot

roles/raspberrypi/tasks/setup/Ubuntu.yml

@@ -2,7 +2,7 @@
 - name: Enable cgroup via boot commandline if not already enabled for Ubuntu on a Raspberry Pi
   lineinfile:
     path: /boot/firmware/cmdline.txt
-    backrefs: true
+    backrefs: yes
     regexp: '^((?!.*\bcgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory\b).*)$'
     line: '\1 cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory'
   notify: reboot

roles/reset/tasks/main.yml

@@ -3,7 +3,7 @@
   systemd:
     name: "{{ item }}"
     state: stopped
-    enabled: false
+    enabled: no
   failed_when: false
   with_items:
     - k3s
@@ -46,20 +46,9 @@
     - /var/lib/rancher/
     - /var/lib/cni/
 
-- name: Remove K3s http_proxy files
-  file:
-    name: "{{ item }}"
-    state: absent
-  with_items:
-    - "{{ systemd_dir }}/k3s.service.d/http_proxy.conf"
-    - "{{ systemd_dir }}/k3s.service.d"
-    - "{{ systemd_dir }}/k3s-node.service.d/http_proxy.conf"
-    - "{{ systemd_dir }}/k3s-node.service.d"
-  when: proxy_env is defined
-
 - name: Reload daemon_reload
   systemd:
-    daemon_reload: true
+    daemon_reload: yes
 
 - name: Remove tmp directory used for manifests
   file:

site.yml

@@ -2,16 +2,14 @@
 - name: Prepare Proxmox cluster
   hosts: proxmox
   gather_facts: true
-  become: true
-  environment: "{{ proxy_env | default({}) }}"
+  become: yes
   roles:
     - role: proxmox_lxc
       when: proxmox_lxc_configure
 
 - name: Prepare k3s nodes
   hosts: k3s_cluster
-  gather_facts: true
-  environment: "{{ proxy_env | default({}) }}"
+  gather_facts: yes
   roles:
     - role: lxc
       become: true
@@ -22,27 +20,21 @@
       become: true
     - role: raspberrypi
       become: true
-    - role: k3s_custom_registries
-      become: true
-      when: custom_registries
 
 - name: Setup k3s servers
   hosts: master
-  environment: "{{ proxy_env | default({}) }}"
   roles:
     - role: k3s_server
       become: true
 
 - name: Setup k3s agents
   hosts: node
-  environment: "{{ proxy_env | default({}) }}"
   roles:
     - role: k3s_agent
       become: true
 
 - name: Configure k3s cluster
   hosts: master
-  environment: "{{ proxy_env | default({}) }}"
   roles:
     - role: k3s_server_post
       become: true