Encryption and major changes

ansible/roles/microk8s/tasks/microk8s/install.yml

@@ -1,4 +1,3 @@
-# Install a snap with classic confinement
 - name: Microk8s | Installing microk8s from channel '{{ microk8s_channel }}'
   become: true
   community.general.snap:
@@ -6,6 +5,25 @@
     channel: "{{ microk8s_channel }}"
     classic: true
 
+- name: Create encryption configuration
+  become: true
+  ansible.builtin.copy:
+    content: |
+      ---
+      apiVersion: apiserver.config.k8s.io/v1
+      kind: EncryptionConfiguration
+      resources:
+        - resources:
+          - secrets
+          providers:
+          - aescbc:
+              keys:
+              - name: k8s-crypto
+                secret: {{ microk8s_encryption_secret }}
+          - identity: {}
+    dest: "{{ microk8s_encryption_cfg }}"
+    mode: "0600"
+
 - name: Microk8s | Patch microk8s configuration
   notify: ["Restart microk8s"]
   block:
@@ -16,6 +34,13 @@
         line: "--allow-privileged=true"
         insertafter: "^--insecure-port=0$"
 
+    - name: Microk8s | Enable encryption provider
+      become: true
+      ansible.builtin.lineinfile:
+        path: /var/snap/microk8s/current/args/kube-apiserver
+        line: "--encryption-provider-config=/a13labs/microk8s/encryption.yaml"
+        insertafter: "^--insecure-port=0$"
+
     - name: Microk8s | Fixing Disk Pressure
       become: true
       ansible.builtin.lineinfile:
@@ -64,17 +89,8 @@
     - { plugin: "ingress", wait: 60, args: "", enabled: true }
     - { plugin: "hostpath-storage", wait: 10, args: "", enabled: true }
 
-- name: Microk8s | Check if ufw is enabled
-  become: true
-  ansible.builtin.shell:
-    cmd: "ufw status"
-  register: ufw_status
-  changed_when: false
-
 - name: Microk8s | Configure required ufw rules
   ansible.builtin.include_tasks: microk8s/ufw.yml
-  when:
-    - ufw_status.stdout.find("Status: active") != -1
 
 - name: Microk8s | Store kubeconfig
   ansible.builtin.shell:

ansible/roles/microk8s/tasks/microk8s/ufw.yml

@@ -6,7 +6,7 @@
     interface: "{{ item }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_net_devices }}"
+    - "{{ microk8s_net_devices }}"
   retries: 5
   delay: 10
 
@@ -18,7 +18,7 @@
     interface: "{{ item }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_net_devices }}"
+    - "{{ microk8s_net_devices }}"
   retries: 5
   delay: 10
 
@@ -31,7 +31,7 @@
     proto: "{{ item.proto }}"
     comment: ansible managed
   with_items:
-    - "{{ k8s_incoming_traffic }}"
+    - "{{ microk8s_incoming_traffic }}"
   retries: 5
   delay: 10
 
@@ -43,7 +43,7 @@
     direction: out
     comment: ansible managed
   with_items:
-    - "{{ k8s_outgoing_traffic }}"
+    - "{{ microk8s_outgoing_traffic }}"
   retries: 5
   delay: 10
 
@@ -56,6 +56,6 @@
     proto: tcp
     comment: ansible managed
   with_items:
-    - "{{ k8s_allowed_hosts }}"
+    - "{{ microk8s_allowed_hosts }}"
   retries: 5
   delay: 10