payphone/playbooks/01-setup.yml

- name: Install K3s and Apply Security Configurations on All Nodes
  hosts: all
  become: true
  tasks:
    - name: Install curl
      ansible.builtin.apt:
        name: curl
        state: present
      when: ansible_os_family == "Debian"

    - name: Download k3s install script
      ansible.builtin.get_url:
        url: https://get.k3s.io
        dest: /tmp/k3s_install.sh
        mode: '0755'

    - name: Install Python Kubernetes client
      ansible.builtin.apt:
        name: python3-kubernetes
        state: present

    - name: Disable UFW
      ansible.builtin.command: ufw disable
      changed_when: false

    - name: Disable password authentication for SSH
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PasswordAuthentication'
        line: 'PasswordAuthentication no'
        state: present
        backup: true

    - name: Disable root password login
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: '^PermitRootLogin'
        line: 'PermitRootLogin prohibit-password'
        state: present
        backup: true

    - name: Restart SSH to apply config
      ansible.builtin.service:
        name: ssh
        state: restarted

    - name: Install fail2ban
      ansible.builtin.apt:
        name: fail2ban
        state: present
        update_cache: true

    - name: Configure fail2ban for SSH
      ansible.builtin.blockinfile:
        path: /etc/fail2ban/jail.local
        create: true
        block: |
          [sshd]
          enabled  = true
          port     = ssh
          logpath  = /var/log/auth.log
          maxretry = 5
          bantime  = 3600
        mode: '0644'

    - name: Restart fail2ban
      ansible.builtin.service:
        name: fail2ban
        state: restarted

- name: Set up K3s on Init Node
  hosts: init
  become: true
  tasks:
    - name: Run k3s Installer
      ansible.builtin.shell: |
        INSTALL_K3S_EXEC="server --tls-san {{ ansible_host }} --flannel-backend=wireguard-native --cluster-init" \
        sh /tmp/k3s_install.sh
      args:
        creates: /usr/local/bin/k3s

    - name: Ensure K3s Service is Started and Enabled
      ansible.builtin.systemd:
        name: k3s
        enabled: true
        state: started

    - name: Get Joining Token
      ansible.builtin.command: cat /var/lib/rancher/k3s/server/node-token
      register: k3s_token
      run_once: true
      tags: skip_ansible_lint
      changed_when: false

- name: Set up K3s on Master Nodes
  hosts: master
  become: true
  tasks:
    - name: Run k3s Installer
      ansible.builtin.shell: |
        INSTALL_K3S_EXEC="server --flannel-backend=wireguard-native --tls-san {{ ansible_host }}" \
        K3S_URL="https://{{ hostvars[groups['init'][0]].ansible_host }}:6443" \
        K3S_TOKEN="{{ hostvars[groups['init'][0]].k3s_token.stdout }}" sh /tmp/k3s_install.sh
      args:
        creates: /usr/local/bin/k3s

    - name: Ensure k3s service is started and enabled
      ansible.builtin.systemd:
        name: k3s
        enabled: true
        state: started

- name: Set up K3s on Worker Nodes
  hosts: worker
  become: true
  tasks:
    - name: Run k3s Installer
      ansible.builtin.shell: |
        INSTALL_K3S_EXEC="agent" K3S_URL="https://{{ hostvars[groups['init'][0]].ansible_host }}:6443" \
        K3S_TOKEN="{{ hostvars[groups['init'][0]].k3s_token.stdout }}" sh /tmp/k3s_install.sh
      args:
        creates: /usr/local/bin/k3s

    - name: Ensure k3s service is started and enabled
      ansible.builtin.systemd:
        name: k3s-agent
        enabled: true
        state: started

- name: Install Helm in All Nodes
  hosts: all
  become: true
  tasks:
    - name: Download Helm Installation Script
      ansible.builtin.get_url:
        url: https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
        dest: /tmp/get_helm.sh
        mode: '0755'

    - name: Run helm installer
      ansible.builtin.command: /tmp/get_helm.sh
      args:
        creates: /usr/local/bin/helm

- name: Wait for All K3s Nodes to Become Ready
  hosts: init
  become: true
  tasks:
    - name: Wait until all nodes report Ready
      ansible.builtin.shell: |
        kubectl wait --for=condition=Ready node --all --timeout=10m
      register: wait_nodes
      retries: 5
      delay: 30
      until: wait_nodes.rc == 0
      changed_when: false

- name: Set Up Node Labels and Taints
  hosts: init
  become: true
  tasks:
    - name: Set Rack Tags to All Nodes
      loop: "{{ groups['all'] }}"
      kubernetes.core.k8s:
        api_version: v1
        kind: Node
        name: "{{ item }}"
        definition:
          metadata:
            labels:
              topology.kubernetes.io/zone: "{{ hostvars[item].rack }}"
        kubeconfig: /etc/rancher/k3s/k3s.yaml
        state: present

    - name: Set Scylla Tags to Scylla Nodes
      loop: "{{ groups['scylla'] }}"
      kubernetes.core.k8s:
        api_version: v1
        kind: Node
        name: "{{ item }}"
        definition:
          metadata:
            labels:
              scylla.scylladb.com/node-type: scylla
          spec:
            taints:
              - key: scylla-operator.scylladb.com/dedicated
                value: scyllaclusters
                effect: NoSchedule
        kubeconfig: /etc/rancher/k3s/k3s.yaml
        state: present

- name: Create Containerd Socket Symlink
  hosts: all
  become: true
  tasks:
    - name: Create Containerd Symlink
      ansible.builtin.command: |
        ln -s /run/k3s/containerd/containerd.sock /run/containerd/containerd.sock
      args:
        creates: /run/containerd/containerd.sock