mirror of
https://github.com/techno-tim/k3s-ansible.git
synced 2026-08-09 07:23:19 +02:00
Techno Tim
56bb912bd3
k3s recommends swap be disabled on every node. Add a disable_swap toggle (default true) to the prereq role that turns swap off now and comments out the swap entries in /etc/fstab so swap stays off across reboots. The change is applied uniformly across all k3s_cluster hosts (all-or-nothing) since leaving swap on for some nodes but not others creates uneven scheduling and latency. - roles/prereq/defaults/main.yml: add disable_swap: true default - roles/prereq/tasks/main.yml: idempotent swapoff -a and fstab comment-out block gated on disable_swap - inventory/sample/group_vars/all.yml: document the new sample variable - README.md: document the disable_swap option - .github/scripts/test-disable-swap.sh: regression test - .pre-commit-config.yaml: wire the test into pre-commit Closes #670
113 lines
3.1 KiB
YAML
113 lines
3.1 KiB
YAML
---
|
|
- name: Set same timezone on every Server
|
|
community.general.timezone:
|
|
name: "{{ system_timezone }}"
|
|
when: (system_timezone is defined) and (system_timezone != "Your/Timezone")
|
|
|
|
# k3s recommends swap be disabled on all nodes. Disabling swap is all-or-nothing
|
|
# across the cluster: leaving it enabled on some nodes but not others creates
|
|
# uneven scheduling/latency behavior. This block turns swap off and comments out
|
|
# the swap entries in /etc/fstab so it stays off across reboots. It is idempotent
|
|
# and a no-op when swap is already disabled or swapoff is unavailable.
|
|
- name: Disable swap on all cluster nodes
|
|
when: disable_swap
|
|
block:
|
|
- name: Turn off swap now
|
|
ansible.builtin.command: swapoff -a
|
|
register: swapoff_result
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Comment out swap entries in fstab
|
|
ansible.builtin.replace:
|
|
path: /etc/fstab
|
|
regexp: '^([^#][^\n]*\s+swap\s+)'
|
|
replace: '# \\1'
|
|
register: fstab_swap
|
|
|
|
|
|
- name: Set SELinux to disabled state
|
|
ansible.posix.selinux:
|
|
state: disabled
|
|
when: ansible_os_family == "RedHat"
|
|
|
|
- name: Enable IPv4 forwarding
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "1"
|
|
state: present
|
|
reload: true
|
|
tags: sysctl
|
|
|
|
- name: Enable IPv6 forwarding
|
|
ansible.posix.sysctl:
|
|
name: net.ipv6.conf.all.forwarding
|
|
value: "1"
|
|
state: present
|
|
reload: true
|
|
tags: sysctl
|
|
|
|
- name: Enable IPv6 router advertisements
|
|
ansible.posix.sysctl:
|
|
name: net.ipv6.conf.all.accept_ra
|
|
value: "2"
|
|
state: present
|
|
reload: true
|
|
tags: sysctl
|
|
|
|
- name: Check if br_netfilter module exists
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
find /lib/modules/$(uname -r) -name "br_netfilter.ko*" | wc -l
|
|
args:
|
|
executable: /bin/bash
|
|
register: br_netfilter_exists
|
|
changed_when: false
|
|
when: ansible_os_family == "RedHat"
|
|
tags: sysctl
|
|
|
|
- name: Install kernel-modules-extra if br_netfilter missing
|
|
ansible.builtin.yum:
|
|
name: kernel-modules-extra
|
|
state: present
|
|
update_cache: true
|
|
register: kernel_modules_installed
|
|
when:
|
|
- ansible_os_family == "RedHat"
|
|
- br_netfilter_exists.stdout | int == 0
|
|
|
|
- name: Add br_netfilter to /etc/modules-load.d/
|
|
ansible.builtin.copy:
|
|
content: br_netfilter
|
|
dest: /etc/modules-load.d/br_netfilter.conf
|
|
mode: u=rw,g=,o=
|
|
when: ansible_os_family == "RedHat"
|
|
|
|
- name: Load br_netfilter
|
|
community.general.modprobe:
|
|
name: br_netfilter
|
|
state: present
|
|
when: ansible_os_family == "RedHat"
|
|
|
|
- name: Set bridge-nf-call-iptables (just to be sure)
|
|
ansible.posix.sysctl:
|
|
name: "{{ item }}"
|
|
value: "1"
|
|
state: present
|
|
reload: true
|
|
when: ansible_os_family == "RedHat"
|
|
loop:
|
|
- net.bridge.bridge-nf-call-iptables
|
|
- net.bridge.bridge-nf-call-ip6tables
|
|
tags: sysctl
|
|
|
|
- name: Add /usr/local/bin to sudo secure_path
|
|
ansible.builtin.lineinfile:
|
|
line: Defaults secure_path = {{ secure_path[ansible_os_family] }}
|
|
regexp: Defaults(\s)*secure_path(\s)*=
|
|
state: present
|
|
insertafter: EOF
|
|
path: /etc/sudoers
|
|
validate: visudo -cf %s
|
|
when: ansible_os_family in [ "RedHat", "Suse" ]
|