44 行
1.6 KiB
YAML
44 行
1.6 KiB
YAML
- name: Ensure nftables is available on control-plane nodes
|
|
ansible.builtin.apt:
|
|
name: nftables
|
|
state: present
|
|
|
|
- name: Validate and deploy the selective relay rules
|
|
ansible.builtin.template:
|
|
src: control-plane-relay.nft.j2
|
|
dest: /etc/k3s-control-plane-relay.nft
|
|
mode: "0644"
|
|
validate: /usr/sbin/nft --check --file %s
|
|
register: control_plane_relay_rules
|
|
|
|
- name: Configure public DNS names for selective relay
|
|
ansible.builtin.copy:
|
|
content: "{{ tailscale_control_plane_relay_peers | to_nice_json }}\n"
|
|
dest: /etc/k3s-control-plane-relay.json
|
|
mode: "0644"
|
|
register: control_plane_relay_peers
|
|
|
|
- name: Install the selective relay resolver and systemd units
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { src: k3s-control-plane-relay.py, dest: /usr/local/sbin/k3s-control-plane-relay, mode: "0755" }
|
|
- { src: k3s-control-plane-relay.service, dest: /etc/systemd/system/k3s-control-plane-relay.service, mode: "0644" }
|
|
- { src: k3s-control-plane-relay.timer, dest: /etc/systemd/system/k3s-control-plane-relay.timer, mode: "0644" }
|
|
register: control_plane_relay_files
|
|
|
|
- name: Persist and apply selective relay
|
|
ansible.builtin.systemd:
|
|
name: k3s-control-plane-relay
|
|
enabled: true
|
|
daemon_reload: "{{ control_plane_relay_files.changed }}"
|
|
state: "{{ 'restarted' if control_plane_relay_rules.changed or control_plane_relay_peers.changed or control_plane_relay_files.changed else omit }}"
|
|
|
|
- name: Enable periodic DNS refresh
|
|
ansible.builtin.systemd:
|
|
name: k3s-control-plane-relay.timer
|
|
enabled: true
|
|
state: started
|