diff --git a/ansible/k8s/.gitignore b/ansible/k8s/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..eb200e400865633fc2118f09572fb4b85f062139
--- /dev/null
+++ b/ansible/k8s/.gitignore
@@ -0,0 +1,5 @@
+.idea
+.venv
+
+# autogenerated
+.template
diff --git a/ansible/k8s/ansible.cfg b/ansible/k8s/ansible.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..cdeb744a9bc6616aa1dd0d88d383fb645f4e6810
--- /dev/null
+++ b/ansible/k8s/ansible.cfg
@@ -0,0 +1,6 @@
+[defaults]
+ansible_managed = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S by {uid} on {host}
+inventory = inventory.yaml
+
+[ssh_connection]
+ssh_args = -o StrictHostKeyChecking=accept-new
diff --git a/ansible/k8s/bootstrap.sh b/ansible/k8s/bootstrap.sh
new file mode 100755
index 0000000000000000000000000000000000000000..67f34a583e1368f4e10d7ef8a23194f40e4e9eee
--- /dev/null
+++ b/ansible/k8s/bootstrap.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# This script creates a Python env, enters it and installs
+# ansible and requirements from the requirements.galaxy.yaml
+
+[[ ! -d .venv ]] && python3 -m venv .venv
+source .venv/bin/activate
+
+pip3 install ansible ansible-lint
+
+ansible-galaxy install "$1" -r requirements.galaxy.yaml
+
+# to stay in our comfy virtualenv
+exec "${SHELL:bash}"
diff --git a/ansible/k8s/inventory.yaml b/ansible/k8s/inventory.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..99ca2168fb41ec1f0fd83881b7df96dcd056d245
--- /dev/null
+++ b/ansible/k8s/inventory.yaml
@@ -0,0 +1,44 @@
+all:
+ hosts:
+ # Use OpenSSH config to make it confortable
+ master-01.internal.maze:
+ base_motd_text: "Maze master-01"
+ base_hostname: "master-01"
+ host_ip: "11"
+ master-02.internal.maze:
+ base_motd_text: "Maze master-02"
+ base_hostname: "master-02"
+ host_ip: "12"
+ master-03.internal.maze:
+ base_motd_text: "Maze master-03"
+ base_hostname: "master-03"
+ host_ip: "13"
+ worker-01.internal.maze:
+ base_motd_text: "Maze worker-01"
+ base_hostname: "worker-01"
+ host_ip: "21"
+ worker-02.internal.maze:
+ base_motd_text: "Maze worker-02"
+ base_hostname: "worker-02"
+ host_ip: "22"
+ worker-03.internal.maze:
+ base_motd_text: "Maze worker-03"
+ base_hostname: "worker-03"
+ host_ip: "23"
+
+ children:
+ masters:
+ hosts:
+ master-01.internal.maze: {}
+ master-02.internal.maze: {}
+ master-03.internal.maze: {}
+ workers:
+ hosts:
+ worker-01.internal.maze: {}
+ worker-02.internal.maze: {}
+ worker-03.internal.maze: {}
+
+ kube:
+ children:
+ masters: {}
+ workers: {}
diff --git a/ansible/k8s/kube/base.yaml b/ansible/k8s/kube/base.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..5fd8ca2b07d505c5e1f77d08ab17b688aea1b021
--- /dev/null
+++ b/ansible/k8s/kube/base.yaml
@@ -0,0 +1,21 @@
+---
+- hosts: [kube]
+ become: yes
+ roles:
+ - role: kszk.base
+ tags: ["base"]
+ vars_files:
+ - "vars/kube.yaml"
+ tasks:
+ - name: Remove other firewalls
+ package:
+ state: absent
+ name:
+ - ufw
+ - firewalld
+ - name: Set authorized keys for ubuntu user
+ ansible.posix.authorized_key:
+ user: ubuntu
+ state: present
+ key: "{{ item }}"
+ loop: "{{ ssh_keys }}"
diff --git a/ansible/k8s/kube/templates/etc/netplan/01-netcfg.yaml.j2 b/ansible/k8s/kube/templates/etc/netplan/01-netcfg.yaml.j2
new file mode 100644
index 0000000000000000000000000000000000000000..05f8b937521a5992d0f45cea97deb6824c6c463d
--- /dev/null
+++ b/ansible/k8s/kube/templates/etc/netplan/01-netcfg.yaml.j2
@@ -0,0 +1,22 @@
+#
+# !!!
+# {{ ansible_managed }}
+# !!!
+
+network:
+ version: 2
+ renderer: networkd
+ ethernets:
+ kubegw:
+ set-name: eth0
+ match:
+ macaddress: 7a:19:32:cf:f4:{{ host_ip }}
+ optional: false
+ addresses:
+ - 192.168.98.{{ host_ip }}/22
+ nameservers:
+ search: [sch.bme.hu, internal]
+ addresses: [152.66.208.1, 8.8.8.8]
+ routes:
+ - to: default
+ via: 192.168.99.254
diff --git a/ansible/k8s/kube/vars/kube.yaml b/ansible/k8s/kube/vars/kube.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..5d99bc63f1b5fbc77af0ed85ff8f7384f8fed2c8
--- /dev/null
+++ b/ansible/k8s/kube/vars/kube.yaml
@@ -0,0 +1,19 @@
+# KSZK Base role
+base_motd_playbook_url: https://git.sch.bme.hu/rlacko/maze
+# hostname, motd_text set in the inventory
+
+base_netplan_config_file: etc/netplan/01-netcfg.yaml.j2
+base_netplan: yes
+
+base_ssh:
+ port: 22
+ permitRootLogin: "no"
+ pubkeyAuthentication: "yes"
+ passwordAuthentication: "no"
+ allow:
+ users: "ubuntu"
+
+# Playbook vars
+
+ssh_keys:
+ - https://git.sch.bme.hu/rlacko.keys
diff --git a/ansible/k8s/kubespray/init.sh b/ansible/k8s/kubespray/init.sh
new file mode 100755
index 0000000000000000000000000000000000000000..1c6aeb75032b2a31e2d90c29f51136716a321457
--- /dev/null
+++ b/ansible/k8s/kubespray/init.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+[[ ! -d .venv ]] && python3 -m venv .venv
+source .venv/bin/activate
+
+pip3 install -r kubespray-repo/requirements.txt
+
+exec ${SHELL:-sh} "$@"
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/all.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/all.yml
new file mode 100644
index 0000000000000000000000000000000000000000..0f79a0d205e9bae6733f44c2047d7075a9b2ec72
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/all.yml
@@ -0,0 +1,119 @@
+---
+## Directory where etcd data stored
+etcd_data_dir: /var/lib/etcd
+
+## Experimental kubeadm etcd deployment mode. Available only for new deployment
+etcd_kubeadm_enabled: true
+
+## Directory where the binaries will be installed
+bin_dir: /usr/local/bin
+
+## The access_ip variable is used to define how other nodes should access
+## the node. This is used in flannel to allow other flannel nodes to see
+## this node for example. The access_ip is really useful AWS and Google
+## environments where the nodes are accessed remotely by the "public" ip,
+## but don't know about that address themselves.
+# access_ip: 1.1.1.1
+
+
+## External LB example config
+## apiserver_loadbalancer_domain_name: "elb.some.domain"
+# loadbalancer_apiserver:
+# address: 1.2.3.4
+# port: 1234
+
+## Internal loadbalancers for apiservers
+# loadbalancer_apiserver_localhost: true
+# valid options are "nginx" or "haproxy"
+# loadbalancer_apiserver_type: nginx # valid values "nginx" or "haproxy"
+
+## If the cilium is going to be used in strict mode, we can use the
+## localhost connection and not use the external LB. If this parameter is
+## not specified, the first node to connect to kubeapi will be used.
+# use_localhost_as_kubeapi_loadbalancer: true
+
+## Local loadbalancer should use this port
+## And must be set port 6443
+loadbalancer_apiserver_port: 6443
+
+## If loadbalancer_apiserver_healthcheck_port variable defined, enables proxy liveness check for nginx.
+loadbalancer_apiserver_healthcheck_port: 8081
+
+### OTHER OPTIONAL VARIABLES
+
+## Upstream dns servers
+# upstream_dns_servers:
+# - 8.8.8.8
+# - 8.8.4.4
+
+## There are some changes specific to the cloud providers
+## for instance we need to encapsulate packets with some network plugins
+## If set the possible values are either 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
+## When openstack is used make sure to source in the openstack credentials
+## like you would do when using openstack-client before starting the playbook.
+# cloud_provider:
+
+## When cloud_provider is set to 'external', you can set the cloud controller to deploy
+## Supported cloud controllers are: 'openstack' and 'vsphere'
+## When openstack or vsphere are used make sure to source in the required fields
+# external_cloud_provider:
+
+## Set these proxy values in order to update package manager and docker daemon to use proxies
+# http_proxy: ""
+# https_proxy: ""
+
+## Refer to roles/kubespray-defaults/defaults/main.yml before modifying no_proxy
+# no_proxy: ""
+
+## Some problems may occur when downloading files over https proxy due to ansible bug
+## https://github.com/ansible/ansible/issues/32750. Set this variable to False to disable
+## SSL validation of get_url module. Note that kubespray will still be performing checksum validation.
+# download_validate_certs: False
+
+## If you need exclude all cluster nodes from proxy and other resources, add other resources here.
+# additional_no_proxy: ""
+
+## If you need to disable proxying of os package repositories but are still behind an http_proxy set
+## skip_http_proxy_on_os_packages to true
+## This will cause kubespray not to set proxy environment in /etc/yum.conf for centos and in /etc/apt/apt.conf for debian/ubuntu
+## Special information for debian/ubuntu - you have to set the no_proxy variable, then apt package will install from your source of wish
+# skip_http_proxy_on_os_packages: false
+
+## Since workers are included in the no_proxy variable by default, docker engine will be restarted on all nodes (all
+## pods will restart) when adding or removing workers. To override this behaviour by only including master nodes in the
+## no_proxy variable, set below to true:
+no_proxy_exclude_workers: false
+
+## Certificate Management
+## This setting determines whether certs are generated via scripts.
+## Chose 'none' if you provide your own certificates.
+## Option is "script", "none"
+# cert_management: script
+
+## Set to true to allow pre-checks to fail and continue deployment
+# ignore_assert_errors: false
+
+## The read-only port for the Kubelet to serve on with no authentication/authorization. Uncomment to enable.
+# kube_read_only_port: 10255
+
+## Set true to download and cache container
+download_container: false
+skip_downloads: false
+
+## Deploy container engine
+# Set false if you want to deploy container engine manually.
+# deploy_container_engine: true
+
+## Red Hat Enterprise Linux subscription registration
+## Add either RHEL subscription Username/Password or Organization ID/Activation Key combination
+## Update RHEL subscription purpose usage, role and SLA if necessary
+# rh_subscription_username: ""
+# rh_subscription_password: ""
+# rh_subscription_org_id: ""
+# rh_subscription_activation_key: ""
+# rh_subscription_usage: "Development"
+# rh_subscription_role: "Red Hat Enterprise Server"
+# rh_subscription_sla: "Self-Support"
+
+## Check if access_ip responds to ping. Set false if your firewall blocks ICMP.
+# ping_access_ip: true
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/crio.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/crio.yml
new file mode 100644
index 0000000000000000000000000000000000000000..348052766f74af93ae4dd20661459e7c6766fd32
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/crio.yml
@@ -0,0 +1,8 @@
+crio_registries_mirrors:
+ - prefix: docker.io
+ insecure: false
+ blocked: false
+ location: registry-1.docker.io
+ mirrors:
+ - location: mirror.gcr.io
+ insecure: false
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/docker.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/docker.yml
new file mode 100644
index 0000000000000000000000000000000000000000..4e968c300a658136acb05d553cdc5cde5148351b
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/docker.yml
@@ -0,0 +1,59 @@
+---
+## Uncomment this if you want to force overlay/overlay2 as docker storage driver
+## Please note that overlay2 is only supported on newer kernels
+# docker_storage_options: -s overlay2
+
+## Enable docker_container_storage_setup, it will configure devicemapper driver on Centos7 or RedHat7.
+docker_container_storage_setup: false
+
+## It must be define a disk path for docker_container_storage_setup_devs.
+## Otherwise docker-storage-setup will be executed incorrectly.
+# docker_container_storage_setup_devs: /dev/vdb
+
+## Uncomment this if you want to change the Docker Cgroup driver (native.cgroupdriver)
+## Valid options are systemd or cgroupfs, default is systemd
+# docker_cgroup_driver: systemd
+
+## Only set this if you have more than 3 nameservers:
+## If true Kubespray will only use the first 3, otherwise it will fail
+docker_dns_servers_strict: false
+
+# Path used to store Docker data
+docker_daemon_graph: "/var/lib/docker"
+
+## Used to set docker daemon iptables options to true
+docker_iptables_enabled: "false"
+
+# Docker log options
+# Rotate container stderr/stdout logs at 50m and keep last 5
+docker_log_opts: "--log-opt max-size=50m --log-opt max-file=5"
+
+# define docker bin_dir
+docker_bin_dir: "/usr/bin"
+
+# keep docker packages after installation; speeds up repeated ansible provisioning runs when '1'
+# kubespray deletes the docker package on each run, so caching the package makes sense
+docker_rpm_keepcache: 1
+
+## An obvious use case is allowing insecure-registry access to self hosted registries.
+## Can be ipaddress and domain_name.
+## example define 172.19.16.11 or mirror.registry.io
+# docker_insecure_registries:
+# - mirror.registry.io
+# - 172.19.16.11
+
+## Add other registry,example China registry mirror.
+# docker_registry_mirrors:
+# - https://registry.docker-cn.com
+# - https://mirror.aliyuncs.com
+
+## If non-empty will override default system MountFlags value.
+## This option takes a mount propagation flag: shared, slave
+## or private, which control whether mounts in the file system
+## namespace set up for docker will receive or propagate mounts
+## and unmounts. Leave empty for system default
+# docker_mount_flags:
+
+## A string of extra options to pass to the docker daemon.
+## This string should be exactly as you wish it to appear.
+# docker_options: ""
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/offline.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/offline.yml
new file mode 100644
index 0000000000000000000000000000000000000000..3bdefcded5c1a2dae22b66a05e9a5445a0bd3f57
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/all/offline.yml
@@ -0,0 +1,79 @@
+---
+## Global Offline settings
+### Private Container Image Registry
+# registry_host: "myprivateregisry.com"
+# files_repo: "http://myprivatehttpd"
+### If using CentOS, RedHat, AlmaLinux or Fedora
+# yum_repo: "http://myinternalyumrepo"
+### If using Debian
+# debian_repo: "http://myinternaldebianrepo"
+### If using Ubuntu
+# ubuntu_repo: "http://myinternalubunturepo"
+
+## Container Registry overrides
+# kube_image_repo: "{{ registry_host }}"
+# gcr_image_repo: "{{ registry_host }}"
+# docker_image_repo: "{{ registry_host }}"
+# quay_image_repo: "{{ registry_host }}"
+
+## Kubernetes components
+# kubeadm_download_url: "{{ files_repo }}/kubernetes/{{ kube_version }}/kubeadm"
+# kubectl_download_url: "{{ files_repo }}/kubernetes/{{ kube_version }}/kubectl"
+# kubelet_download_url: "{{ files_repo }}/kubernetes/{{ kube_version }}/kubelet"
+
+## CNI Plugins
+# cni_download_url: "{{ files_repo }}/kubernetes/cni/cni-plugins-linux-{{ image_arch }}-{{ cni_version }}.tgz"
+
+## cri-tools
+# crictl_download_url: "{{ files_repo }}/kubernetes/cri-tools/crictl-{{ crictl_version }}-{{ ansible_system | lower }}-{{ image_arch }}.tar.gz"
+
+## [Optional] etcd: only if you **DON'T** use etcd_deployment=host
+# etcd_download_url: "{{ files_repo }}/kubernetes/etcd/etcd-{{ etcd_version }}-linux-amd64.tar.gz"
+
+# [Optional] Calico: If using Calico network plugin
+# calicoctl_download_url: "{{ files_repo }}/kubernetes/calico/{{ calico_ctl_version }}/calicoctl-linux-{{ image_arch }}"
+# [Optional] Calico with kdd: If using Calico network plugin with kdd datastore
+# calico_crds_download_url: "{{ files_repo }}/kubernetes/calico/{{ calico_version }}.tar.gz"
+
+# [Optional] helm: only if you set helm_enabled: true
+# helm_download_url: "{{ files_repo }}/helm-{{ helm_version }}-linux-{{ image_arch }}.tar.gz"
+
+# [Optional] crun: only if you set crun_enabled: true
+# crun_download_url: "{{ files_repo }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}"
+
+# [Optional] kata: only if you set kata_containers_enabled: true
+# kata_containers_download_url: "{{ files_repo }}/kata-containers/runtime/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ ansible_architecture }}.tar.xz"
+
+## CentOS/Redhat/AlmaLinux
+### For EL7, base and extras repo must be available, for EL8, baseos and appstream
+### By default we enable those repo automatically
+# rhel_enable_repos: false
+### Docker / Containerd
+# docker_rh_repo_base_url: "{{ yum_repo }}/docker-ce/$releasever/$basearch"
+# docker_rh_repo_gpgkey: "{{ yum_repo }}/docker-ce/gpg"
+
+## Fedora
+### Docker
+# docker_fedora_repo_base_url: "{{ yum_repo }}/docker-ce/{{ ansible_distribution_major_version }}/{{ ansible_architecture }}"
+# docker_fedora_repo_gpgkey: "{{ yum_repo }}/docker-ce/gpg"
+### Containerd
+# containerd_fedora_repo_base_url: "{{ yum_repo }}/containerd"
+# containerd_fedora_repo_gpgkey: "{{ yum_repo }}/docker-ce/gpg"
+
+## Debian
+### Docker
+# docker_debian_repo_base_url: "{{ debian_repo }}/docker-ce"
+# docker_debian_repo_gpgkey: "{{ debian_repo }}/docker-ce/gpg"
+### Containerd
+# containerd_debian_repo_base_url: "{{ ubuntu_repo }}/containerd"
+# containerd_debian_repo_gpgkey: "{{ ubuntu_repo }}/containerd/gpg"
+# containerd_debian_repo_repokey: 'YOURREPOKEY'
+
+## Ubuntu
+### Docker
+# docker_ubuntu_repo_base_url: "{{ ubuntu_repo }}/docker-ce"
+# docker_ubuntu_repo_gpgkey: "{{ ubuntu_repo }}/docker-ce/gpg"
+### Containerd
+# containerd_ubuntu_repo_base_url: "{{ ubuntu_repo }}/containerd"
+# containerd_ubuntu_repo_gpgkey: "{{ ubuntu_repo }}/containerd/gpg"
+# containerd_ubuntu_repo_repokey: 'YOURREPOKEY'
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/etcd.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/etcd.yml
new file mode 100644
index 0000000000000000000000000000000000000000..c1bf5189f733e69f7f7b46c76e54407012ca899b
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/etcd.yml
@@ -0,0 +1,22 @@
+---
+## Etcd auto compaction retention for mvcc key value store in hour
+# etcd_compaction_retention: 0
+
+## Set level of detail for etcd exported metrics, specify 'extensive' to include histogram metrics.
+# etcd_metrics: basic
+
+## Etcd is restricted by default to 512M on systems under 4GB RAM, 512MB is not enough for much more than testing.
+## Set this if your etcd nodes have less than 4GB but you want more RAM for etcd. Set to 0 for unrestricted RAM.
+# etcd_memory_limit: "512M"
+
+## Etcd has a default of 2G for its space quota. If you put a value in etcd_memory_limit which is less than
+## etcd_quota_backend_bytes, you may encounter out of memory terminations of the etcd cluster. Please check
+## etcd documentation for more information.
+# etcd_quota_backend_bytes: "2147483648"
+
+### ETCD: disable peer client cert authentication.
+# This affects ETCD_PEER_CLIENT_CERT_AUTH variable
+# etcd_peer_client_auth: true
+
+## Settings for etcd deployment type
+etcd_deployment_type: host
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/addons.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/addons.yml
new file mode 100644
index 0000000000000000000000000000000000000000..83af3cd1f7710942e301c96823a657ab26097afb
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/addons.yml
@@ -0,0 +1,179 @@
+---
+# Kubernetes dashboard
+# RBAC required. see docs/getting-started.md for access details.
+# dashboard_enabled: false
+
+# Helm deployment
+helm_enabled: false
+
+# Registry deployment
+registry_enabled: false
+# registry_namespace: kube-system
+# registry_storage_class: ""
+# registry_disk_size: "10Gi"
+
+# Metrics Server deployment
+metrics_server_enabled: false
+metrics_server_kubelet_insecure_tls: true
+# metrics_server_metric_resolution: 60s
+# metrics_server_kubelet_preferred_address_types: "InternalIP"
+
+# Rancher Local Path Provisioner
+local_path_provisioner_enabled: false
+# local_path_provisioner_namespace: "local-path-storage"
+# local_path_provisioner_storage_class: "local-path"
+# local_path_provisioner_reclaim_policy: Delete
+# local_path_provisioner_claim_root: /opt/local-path-provisioner/
+# local_path_provisioner_debug: false
+# local_path_provisioner_image_repo: "rancher/local-path-provisioner"
+# local_path_provisioner_image_tag: "v0.0.19"
+# local_path_provisioner_helper_image_repo: "busybox"
+# local_path_provisioner_helper_image_tag: "latest"
+
+# Local volume provisioner deployment
+local_volume_provisioner_enabled: false
+# local_volume_provisioner_namespace: kube-system
+# local_volume_provisioner_nodelabels:
+# - kubernetes.io/hostname
+# - topology.kubernetes.io/region
+# - topology.kubernetes.io/zone
+# local_volume_provisioner_storage_classes:
+# local-storage:
+# host_dir: /mnt/disks
+# mount_dir: /mnt/disks
+# volume_mode: Filesystem
+# fs_type: ext4
+# fast-disks:
+# host_dir: /mnt/fast-disks
+# mount_dir: /mnt/fast-disks
+# block_cleaner_command:
+# - "/scripts/shred.sh"
+# - "2"
+# volume_mode: Filesystem
+# fs_type: ext4
+
+# CephFS provisioner deployment
+cephfs_provisioner_enabled: false
+# cephfs_provisioner_namespace: "cephfs-provisioner"
+# cephfs_provisioner_cluster: ceph
+# cephfs_provisioner_monitors: "172.24.0.1:6789,172.24.0.2:6789,172.24.0.3:6789"
+# cephfs_provisioner_admin_id: admin
+# cephfs_provisioner_secret: secret
+# cephfs_provisioner_storage_class: cephfs
+# cephfs_provisioner_reclaim_policy: Delete
+# cephfs_provisioner_claim_root: /volumes
+# cephfs_provisioner_deterministic_names: true
+
+# RBD provisioner deployment
+rbd_provisioner_enabled: false
+# rbd_provisioner_namespace: rbd-provisioner
+# rbd_provisioner_replicas: 2
+# rbd_provisioner_monitors: "172.24.0.1:6789,172.24.0.2:6789,172.24.0.3:6789"
+# rbd_provisioner_pool: kube
+# rbd_provisioner_admin_id: admin
+# rbd_provisioner_secret_name: ceph-secret-admin
+# rbd_provisioner_secret: ceph-key-admin
+# rbd_provisioner_user_id: kube
+# rbd_provisioner_user_secret_name: ceph-secret-user
+# rbd_provisioner_user_secret: ceph-key-user
+# rbd_provisioner_user_secret_namespace: rbd-provisioner
+# rbd_provisioner_fs_type: ext4
+# rbd_provisioner_image_format: "2"
+# rbd_provisioner_image_features: layering
+# rbd_provisioner_storage_class: rbd
+# rbd_provisioner_reclaim_policy: Delete
+
+# Nginx ingress controller deployment
+ingress_nginx_enabled: false
+# ingress_nginx_host_network: false
+ingress_publish_status_address: ""
+# ingress_nginx_nodeselector:
+# kubernetes.io/os: "linux"
+# ingress_nginx_tolerations:
+# - key: "node-role.kubernetes.io/master"
+# operator: "Equal"
+# value: ""
+# effect: "NoSchedule"
+# - key: "node-role.kubernetes.io/control-plane"
+# operator: "Equal"
+# value: ""
+# effect: "NoSchedule"
+# ingress_nginx_namespace: "ingress-nginx"
+# ingress_nginx_insecure_port: 80
+# ingress_nginx_secure_port: 443
+# ingress_nginx_configmap:
+# map-hash-bucket-size: "128"
+# ssl-protocols: "TLSv1.2 TLSv1.3"
+# ingress_nginx_configmap_tcp_services:
+# 9000: "default/example-go:8080"
+# ingress_nginx_configmap_udp_services:
+# 53: "kube-system/coredns:53"
+# ingress_nginx_extra_args:
+# - --default-ssl-certificate=default/foo-tls
+# ingress_nginx_class: nginx
+
+# ambassador ingress controller deployment
+ingress_ambassador_enabled: false
+# ingress_ambassador_namespace: "ambassador"
+# ingress_ambassador_version: "*"
+# ingress_ambassador_multi_namespaces: false
+
+# ALB ingress controller deployment
+ingress_alb_enabled: false
+# alb_ingress_aws_region: "us-east-1"
+# alb_ingress_restrict_scheme: "false"
+# Enables logging on all outbound requests sent to the AWS API.
+# If logging is desired, set to true.
+# alb_ingress_aws_debug: "false"
+
+# Cert manager deployment
+cert_manager_enabled: false # sounds good; doesn't work - Mike, 2021
+cert_manager_namespace: "cert-manager"
+
+# MetalLB deployment
+metallb_enabled: false
+metallb_speaker_enabled: false
+metallb_ip_range:
+ - "192.168.44.0/24"
+# metallb_speaker_nodeselector:
+# kubernetes.io/os: "linux"
+# metallb_controller_nodeselector:
+# kubernetes.io/os: "linux"
+# metallb_speaker_tolerations:
+# - key: "node-role.kubernetes.io/master"
+# operator: "Equal"
+# value: ""
+# effect: "NoSchedule"
+# - key: "node-role.kubernetes.io/control-plane"
+# operator: "Equal"
+# value: ""
+# effect: "NoSchedule"
+# metallb_controller_tolerations:
+# - key: "node-role.kubernetes.io/master"
+# operator: "Equal"
+# value: ""
+# effect: "NoSchedule"
+# - key: "node-role.kubernetes.io/control-plane"
+# operator: "Equal"
+# value: ""
+# effect: "NoSchedule"
+# metallb_version: v0.9.6
+# metallb_protocol: "layer2"
+# metallb_port: "7472"
+# metallb_limits_cpu: "100m"
+# metallb_limits_mem: "100Mi"
+# metallb_additional_address_pools:
+# kube_service_pool:
+# ip_range:
+# - "10.5.1.50-10.5.1.99"
+# protocol: "layer2"
+# auto_assign: false
+metallb_protocol: "bgp"
+metallb_peers:
+ - peer_address: 192.168.99.254
+ peer_asn: 64512
+ my_asn: 64512
+
+# The plugin manager for kubectl
+krew_enabled: false
+krew_root_dir: "/usr/local/krew"
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-cluster.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-cluster.yml
new file mode 100644
index 0000000000000000000000000000000000000000..24c825121815c320edaa4de0e69e77923d029527
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-cluster.yml
@@ -0,0 +1,335 @@
+---
+# Kubernetes configuration dirs and system namespace.
+# Those are where all the additional config stuff goes
+# the kubernetes normally puts in /srv/kubernetes.
+# This puts them in a sane location and namespace.
+# Editing those values will almost surely break something.
+kube_config_dir: /etc/kubernetes
+kube_script_dir: "{{ bin_dir }}/kubernetes-scripts"
+kube_manifest_dir: "{{ kube_config_dir }}/manifests"
+
+# This is where all the cert scripts and certs will be located
+kube_cert_dir: "{{ kube_config_dir }}/ssl"
+
+# This is where all of the bearer tokens will be stored
+kube_token_dir: "{{ kube_config_dir }}/tokens"
+
+kube_api_anonymous_auth: true
+
+## Change this to use another Kubernetes version, e.g. a current beta release
+# kube_version: v1.21.1
+
+# Where the binaries will be downloaded.
+# Note: ensure that you've enough disk space (about 1G)
+local_release_dir: "/tmp/releases"
+# Random shifts for retrying failed ops like pushing/downloading
+retry_stagger: 5
+
+# This is the group that the cert creation scripts chgrp the
+# cert files to. Not really changeable...
+kube_cert_group: kube-cert
+
+# Cluster Loglevel configuration
+kube_log_level: 2
+
+# Directory where credentials will be stored
+credentials_dir: "{{ inventory_dir }}/credentials"
+
+## It is possible to activate / deactivate selected authentication methods (oidc, static token auth)
+kube_oidc_auth: true
+# kube_token_auth: false
+
+## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
+## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
+
+kube_oidc_url: https://dex.k8s-01.sch.bme.hu
+kube_oidc_client_id: dex-k8s-authenticator
+## Optional settings for OIDC
+# kube_oidc_ca_file: "{{ kube_cert_dir }}/ca.pem"
+kube_oidc_username_claim: email
+# kube_oidc_username_prefix: 'oidc:'
+kube_oidc_groups_claim: groups
+# kube_oidc_groups_prefix: 'oidc:'
+
+## Variables to control webhook authn/authz
+# kube_webhook_token_auth: false
+# kube_webhook_token_auth_url: https://...
+# kube_webhook_token_auth_url_skip_tls_verify: false
+
+## For webhook authorization, authorization_modes must include Webhook
+# kube_webhook_authorization: false
+# kube_webhook_authorization_url: https://...
+# kube_webhook_authorization_url_skip_tls_verify: false
+
+# Choose network plugin (cilium, calico, weave or flannel. Use cni for generic cni plugin)
+# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
+kube_network_plugin: cni
+
+# Setting multi_networking to true will install Multus: https://github.com/intel/multus-cni
+kube_network_plugin_multus: false
+
+# Kubernetes internal network for services, unused block of space.
+kube_service_addresses: 10.43.0.0/18
+
+# internal network. When used, it will assign IP
+# addresses from this range to individual pods.
+# This network must be unused in your network infrastructure!
+kube_pods_subnet: 10.43.64.0/18
+
+# internal network node size allocation (optional). This is the size allocated
+# to each node for pod IP address allocation. Note that the number of pods per node is
+# also limited by the kubelet_max_pods variable which defaults to 110.
+#
+# Example:
+# Up to 64 nodes and up to 254 or kubelet_max_pods (the lowest of the two) pods per node:
+# - kube_pods_subnet: 10.233.64.0/18
+# - kube_network_node_prefix: 24
+# - kubelet_max_pods: 110
+#
+# Example:
+# Up to 128 nodes and up to 126 or kubelet_max_pods (the lowest of the two) pods per node:
+# - kube_pods_subnet: 10.233.64.0/18
+# - kube_network_node_prefix: 25
+# - kubelet_max_pods: 110
+kube_network_node_prefix: 24
+
+# Configure Dual Stack networking (i.e. both IPv4 and IPv6)
+enable_dual_stack_networks: true
+
+# Kubernetes internal network for IPv6 services, unused block of space.
+# This is only used if enable_dual_stack_networks is set to true
+# This provides 4096 IPv6 IPs
+kube_service_addresses_ipv6: fd85:ee78:d8a6:8607::1000/116
+
+# Internal network. When used, it will assign IPv6 addresses from this range to individual pods.
+# This network must not already be in your network infrastructure!
+# This is only used if enable_dual_stack_networks is set to true.
+# This provides room for 256 nodes with 254 pods per node.
+kube_pods_subnet_ipv6: fd85:ee78:d8a6:8607::1:0000/112
+
+# IPv6 subnet size allocated to each for pods.
+# This is only used if enable_dual_stack_networks is set to true
+# This provides room for 254 pods per node.
+kube_network_node_prefix_ipv6: 120
+
+# The port the API Server will be listening on.
+kube_apiserver_ip: "{{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }}"
+kube_apiserver_port: 6443 # (https)
+# kube_apiserver_insecure_port: 8080 # (http)
+# Set to 0 to disable insecure port - Requires RBAC in authorization_modes and kube_api_anonymous_auth: true
+kube_apiserver_insecure_port: 0 # (disabled)
+
+# Kube-proxy proxyMode configuration.
+# Can be ipvs, iptables
+kube_proxy_mode: ipvs
+
+# configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
+# must be set to true for MetalLB to work
+kube_proxy_strict_arp: true
+
+# A string slice of values which specify the addresses to use for NodePorts.
+# Values may be valid IP blocks (e.g. 1.2.3.0/24, 1.2.3.4/32).
+# The default empty string slice ([]) means to use all local addresses.
+# kube_proxy_nodeport_addresses_cidr is retained for legacy config
+kube_proxy_nodeport_addresses: >-
+ {%- if kube_proxy_nodeport_addresses_cidr is defined -%}
+ [{{ kube_proxy_nodeport_addresses_cidr }}]
+ {%- else -%}
+ []
+ {%- endif -%}
+
+# If non-empty, will use this string as identification instead of the actual hostname
+# kube_override_hostname: >-
+# {%- if cloud_provider is defined and cloud_provider in [ 'aws' ] -%}
+# {%- else -%}
+# {{ inventory_hostname }}
+# {%- endif -%}
+
+## Encrypting Secret Data at Rest (experimental)
+kube_encrypt_secret_data: false
+
+# DNS configuration.
+# Kubernetes cluster name, also will be used as DNS domain
+cluster_name: cluster.local
+# Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
+ndots: 2
+# Can be coredns, coredns_dual, manual or none
+dns_mode: coredns
+# Set manual server if using a custom cluster DNS server
+# manual_dns_server: 10.x.x.x
+# Enable nodelocal dns cache
+enable_nodelocaldns: true
+nodelocaldns_ip: 169.254.25.10
+nodelocaldns_health_port: 9254
+# nodelocaldns_external_zones:
+# - zones:
+# - example.com
+# - example.io:1053
+# nameservers:
+# - 1.1.1.1
+# - 2.2.2.2
+# cache: 5
+# - zones:
+# - https://mycompany.local:4453
+# nameservers:
+# - 192.168.0.53
+# cache: 0
+# Enable k8s_external plugin for CoreDNS
+enable_coredns_k8s_external: false
+coredns_k8s_external_zone: k8s_external.local
+# Enable endpoint_pod_names option for kubernetes plugin
+enable_coredns_k8s_endpoint_pod_names: false
+
+# Can be docker_dns, host_resolvconf or none
+resolvconf_mode: docker_dns
+# Deploy netchecker app to verify DNS resolve as an HTTP service
+deploy_netchecker: false
+# Ip address of the kubernetes skydns service
+skydns_server: "{{ kube_service_addresses|ipaddr('net')|ipaddr(3)|ipaddr('address') }}"
+skydns_server_secondary: "{{ kube_service_addresses|ipaddr('net')|ipaddr(4)|ipaddr('address') }}"
+dns_domain: "{{ cluster_name }}"
+
+## Container runtime
+## docker for docker, crio for cri-o and containerd for containerd.
+container_manager: crio
+
+# Additional container runtimes
+kata_containers_enabled: false
+
+kubeadm_certificate_key: "{{ lookup('password', credentials_dir + '/kubeadm_certificate_key.creds length=64 chars=hexdigits') | lower }}"
+
+# K8s image pull policy (imagePullPolicy)
+k8s_image_pull_policy: IfNotPresent
+
+# audit log for kubernetes
+kubernetes_audit: false
+
+# dynamic kubelet configuration
+dynamic_kubelet_configuration: false
+
+# define kubelet config dir for dynamic kubelet
+# kubelet_config_dir:
+default_kubelet_config_dir: "{{ kube_config_dir }}/dynamic_kubelet_dir"
+dynamic_kubelet_configuration_dir: "{{ kubelet_config_dir | default(default_kubelet_config_dir) }}"
+
+# pod security policy (RBAC must be enabled either by having 'RBAC' in authorization_modes or kubeadm enabled)
+podsecuritypolicy_enabled: false
+
+# Custom PodSecurityPolicySpec for restricted policy
+# podsecuritypolicy_restricted_spec: {}
+
+# Custom PodSecurityPolicySpec for privileged policy
+# podsecuritypolicy_privileged_spec: {}
+
+# Make a copy of kubeconfig on the host that runs Ansible in {{ inventory_dir }}/artifacts
+# kubeconfig_localhost: false
+# Download kubectl onto the host that runs Ansible in {{ bin_dir }}
+# kubectl_localhost: false
+
+# A comma separated list of levels of node allocatable enforcement to be enforced by kubelet.
+# Acceptable options are 'pods', 'system-reserved', 'kube-reserved' and ''. Default is "".
+# kubelet_enforce_node_allocatable: pods
+
+## Optionally reserve resources for OS system daemons.
+# system_reserved: true
+## Uncomment to override default values
+# system_memory_reserved: 512Mi
+# system_cpu_reserved: 500m
+## Reservation for master hosts
+# system_master_memory_reserved: 256Mi
+# system_master_cpu_reserved: 250m
+
+# An alternative flexvolume plugin directory
+# kubelet_flexvolumes_plugins_dir: /usr/libexec/kubernetes/kubelet-plugins/volume/exec
+
+## Supplementary addresses that can be added in kubernetes ssl keys.
+## That can be useful for example to setup a keepalived virtual IP
+supplementary_addresses_in_ssl_keys:
+ - "152.66.192.33"
+ - "k8s-01.sch.bme.hu"
+ - "api.k8s-01.sch.bme.hu"
+
+## Running on top of openstack vms with cinder enabled may lead to unschedulable pods due to NoVolumeZoneConflict restriction in kube-scheduler.
+## See https://github.com/kubernetes-sigs/kubespray/issues/2141
+## Set this variable to true to get rid of this issue
+volume_cross_zone_attachment: false
+## Add Persistent Volumes Storage Class for corresponding cloud provider (supported: in-tree OpenStack, Cinder CSI,
+## AWS EBS CSI, Azure Disk CSI, GCP Persistent Disk CSI)
+persistent_volumes_enabled: false
+
+## Container Engine Acceleration
+## Enable container acceleration feature, for example use gpu acceleration in containers
+# nvidia_accelerator_enabled: true
+## Nvidia GPU driver install. Install will by done by a (init) pod running as a daemonset.
+## Important: if you use Ubuntu then you should set in all.yml 'docker_storage_options: -s overlay2'
+## Array with nvida_gpu_nodes, leave empty or comment if you don't want to install drivers.
+## Labels and taints won't be set to nodes if they are not in the array.
+# nvidia_gpu_nodes:
+# - kube-gpu-001
+# nvidia_driver_version: "384.111"
+## flavor can be tesla or gtx
+# nvidia_gpu_flavor: gtx
+## NVIDIA driver installer images. Change them if you have trouble accessing gcr.io.
+# nvidia_driver_install_centos_container: atzedevries/nvidia-centos-driver-installer:2
+# nvidia_driver_install_ubuntu_container: gcr.io/google-containers/ubuntu-nvidia-driver-installer@sha256:7df76a0f0a17294e86f691c81de6bbb7c04a1b4b3d4ea4e7e2cccdc42e1f6d63
+## NVIDIA GPU device plugin image.
+# nvidia_gpu_device_plugin_container: "k8s.gcr.io/nvidia-gpu-device-plugin@sha256:0842734032018be107fa2490c98156992911e3e1f2a21e059ff0105b07dd8e9e"
+
+## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
+# tls_min_version: ""
+
+## Support tls cipher suites.
+# tls_cipher_suites: {}
+# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+# - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+# - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+# - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+# - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+# - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+# - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+# - TLS_ECDHE_RSA_WITH_RC4_128_SHA
+# - TLS_RSA_WITH_3DES_EDE_CBC_SHA
+# - TLS_RSA_WITH_AES_128_CBC_SHA
+# - TLS_RSA_WITH_AES_128_CBC_SHA256
+# - TLS_RSA_WITH_AES_128_GCM_SHA256
+# - TLS_RSA_WITH_AES_256_CBC_SHA
+# - TLS_RSA_WITH_AES_256_GCM_SHA384
+# - TLS_RSA_WITH_RC4_128_SHA
+
+## Amount of time to retain events. (default 1h0m0s)
+event_ttl_duration: "1h0m0s"
+
+## Automatically renew K8S control plane certificates on first Monday of each month
+auto_renew_certificates: false
+# First Monday of each month
+# auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"
+
+crio_pids_limit: 4096
+
+kube_proxy_remove: true
+
+# Fast update and fast reaction
+# https://github.com/kubernetes-sigs/kubespray/blob/master/docs/kubernetes-reliability.md
+## var location:
+## https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/control-plane/defaults/main/main.yml
+kube_kubeadm_controller_extra_args:
+ node-monitor-period: 2s
+ node-monitor-grace-period: 20s
+
+## var location:
+## https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/node/defaults/main.yml
+kubelet_config_extra_args:
+ node-status-update-frequency: 4s
+
+## var location:
+## https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/control-plane/defaults/main/main.yml
+kube_kubeadm_apiserver_extra_args:
+ default-not-ready-toleration-seconds: 30
+ default-unreachable-toleration-seconds: 30
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-calico.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-calico.yml
new file mode 100644
index 0000000000000000000000000000000000000000..642701805334975d0867fa24928749de6ebc5e4d
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-calico.yml
@@ -0,0 +1,112 @@
+# see roles/network_plugin/calico/defaults/main.yml
+
+## With calico it is possible to distributed routes with border routers of the datacenter.
+## Warning : enabling router peering will disable calico's default behavior ('node mesh').
+## The subnets of each nodes will be distributed by the datacenter router
+# peer_with_router: false
+
+# Enables Internet connectivity from containers
+# nat_outgoing: true
+
+# Enables Calico CNI "host-local" IPAM plugin
+# calico_ipam_host_local: true
+
+# add default ippool name
+# calico_pool_name: "default-pool"
+
+# add default ippool blockSize (defaults kube_network_node_prefix)
+# calico_pool_blocksize: 24
+
+# add default ippool CIDR (must be inside kube_pods_subnet, defaults to kube_pods_subnet otherwise)
+# calico_pool_cidr: 1.2.3.4/5
+
+# Add default IPV6 IPPool CIDR. Must be inside kube_pods_subnet_ipv6. Defaults to kube_pods_subnet_ipv6 if not set.
+# calico_pool_cidr_ipv6: fd85:ee78:d8a6:8607::1:0000/112
+
+# Global as_num (/calico/bgp/v1/global/as_num)
+# global_as_num: "64512"
+
+# If doing peering with node-assigned asn where the globas does not match your nodes, you want this
+# to be true. All other cases, false.
+# calico_no_global_as_num: false
+
+# You can set MTU value here. If left undefined or empty, it will
+# not be specified in calico CNI config, so Calico will use built-in
+# defaults. The value should be a number, not a string.
+# calico_mtu: 1500
+
+# Configure the MTU to use for workload interfaces and tunnels.
+# - If Wireguard is enabled, subtract 60 from your network MTU (i.e 1500-60=1440)
+# - Otherwise, if VXLAN or BPF mode is enabled, subtract 50 from your network MTU (i.e. 1500-50=1450)
+# - Otherwise, if IPIP is enabled, subtract 20 from your network MTU (i.e. 1500-20=1480)
+# - Otherwise, if not using any encapsulation, set to your network MTU (i.e. 1500)
+# calico_veth_mtu: 1440
+
+# Advertise Cluster IPs
+# calico_advertise_cluster_ips: true
+
+# Advertise Service External IPs
+# calico_advertise_service_external_ips:
+# - x.x.x.x/24
+# - y.y.y.y/32
+
+# Adveritse Service LoadBalancer IPs
+# calico_advertise_service_loadbalancer_ips:
+# - x.x.x.x/24
+# - y.y.y.y/16
+
+# Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
+calico_datastore: "kdd"
+
+# Choose Calico iptables backend: "Legacy", "Auto" or "NFT"
+# calico_iptables_backend: "Legacy"
+
+# Use typha (only with kdd)
+typha_enabled: true
+
+# Generate TLS certs for secure typha<->calico-node communication
+# typha_secure: false
+
+# Scaling typha: 1 replica per 100 nodes is adequate
+# Number of typha replicas
+# typha_replicas: 1
+
+# Set max typha connections
+# typha_max_connections_lower_limit: 300
+
+# Set calico network backend: "bird", "vxlan" or "none"
+# bird enable BGP routing, required for ipip mode.
+# calico_network_backend: bird
+
+# IP in IP and VXLAN is mutualy exclusive modes.
+# set IP in IP encapsulation mode: "Always", "CrossSubnet", "Never"
+# calico_ipip_mode: 'Always'
+
+# set VXLAN encapsulation mode: "Always", "CrossSubnet", "Never"
+# calico_vxlan_mode: 'Never'
+
+# set VXLAN port and VNI
+# calico_vxlan_vni: 4096
+# calico_vxlan_port: 4789
+
+# Cenable eBPF mode
+# calico_bpf_enabled: false
+
+# If you want to use non default IP_AUTODETECTION_METHOD for calico node set this option to one of:
+# * can-reach=DESTINATION
+# * interface=INTERFACE-REGEX
+# see https://docs.projectcalico.org/reference/node/configuration
+calico_ip_auto_method: "interface=eth0" # Ensure that eth0 is used
+# Choose the iptables insert mode for Calico: "Insert" or "Append".
+# calico_felix_chaininsertmode: Insert
+
+# If you want use the default route interface when you use multiple interface with dynamique route (iproute2)
+# see https://docs.projectcalico.org/reference/node/configuration : FELIX_DEVICEROUTESOURCEADDRESS
+# calico_use_default_route_src_ipaddr: false
+
+# Enable calico traffic encryption with wireguard
+# calico_wireguard_enabled: false
+
+# Under certain situations liveness and readiness probes may need tunning
+# calico_node_livenessprobe_timeout: 10
+# calico_node_readinessprobe_timeout: 10
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-cilium.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-cilium.yml
new file mode 100644
index 0000000000000000000000000000000000000000..b53a79c15e3dc7d936414be4c0b4ef4048abfa07
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-cilium.yml
@@ -0,0 +1,49 @@
+---
+cilium_enable_ipv4: true
+cilium_enable_ipv6: true
+
+# Limits for apps
+cilium_memory_limit: 500M
+cilium_cpu_limit: 500m
+cilium_memory_requests: 64M
+cilium_cpu_requests: 100m
+
+# Overlay Network Mode
+cilium_tunnel_mode: vxlan
+# Optional features
+cilium_enable_prometheus: false
+# Enable if you want to make use of hostPort mappings
+cilium_enable_portmap: false
+# Monitor aggregation level (none/low/medium/maximum)
+cilium_monitor_aggregation: medium
+# Kube Proxy Replacement mode (strict/probe/partial)
+cilium_kube_proxy_replacement: probe
+
+# Hubble
+### Enable Hubble without install
+cilium_enable_hubble: true
+### Enable Hubble Metrics
+cilium_enable_hubble_metrics: true
+### if cilium_enable_hubble_metrics: true
+cilium_hubble_metrics:
+ - dns
+ - drop
+ - tcp
+ - flow
+ - icmp
+ - http
+### Enable Hubble install
+cilium_hubble_install: true
+### Enable auto generate certs if cilium_hubble_install: true
+cilium_hubble_tls_generate: true
+
+# IP address management mode for v1.9+.
+# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
+cilium_ipam_mode: kubernetes
+
+## A dictionary of extra config variables to add to cilium-config, formatted like:
+## cilium_config_extra_vars:
+## var1: "value1"
+## var2: "value2"
+cilium_config_extra_vars:
+ devices: eth0
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-macvlan.yml b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-macvlan.yml
new file mode 100644
index 0000000000000000000000000000000000000000..37db151f83b13b360ba8b2fee40df530439e4e0b
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/group_vars/k8s_cluster/k8s-net-macvlan.yml
@@ -0,0 +1,6 @@
+---
+# private interface, on a l2-network
+macvlan_interface: "eth0"
+
+# Enable nat in default gateway network interface
+enable_nat_default_gateway: true
diff --git a/ansible/k8s/kubespray/inventory/k8s-01/hosts.yaml b/ansible/k8s/kubespray/inventory/k8s-01/hosts.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..9a864000725baafc0a99d67b4158bf14126dc5aa
--- /dev/null
+++ b/ansible/k8s/kubespray/inventory/k8s-01/hosts.yaml
@@ -0,0 +1,61 @@
+# Ansible managed
+
+# Addressing variables: https://github.com/kubernetes-sigs/kubespray/blob/master/docs/vars.md#addressing-variables
+all:
+ hosts:
+ master-01:
+ ansible_user: ubuntu
+ ansible_become: yes
+ ansible_host: 192.168.98.11
+ ip: 192.168.98.11
+ access_ip: 192.168.98.11
+ master-02:
+ ansible_user: ubuntu
+ ansible_become: yes
+ ansible_host: 192.168.98.12
+ ip: 192.168.98.12
+ access_ip: 192.168.98.12
+ master-03:
+ ansible_user: ubuntu
+ ansible_become: yes
+ ansible_host: 192.168.98.13
+ ip: 192.168.98.13
+ access_ip: 192.168.98.13
+ worker-01:
+ ansible_user: ubuntu
+ ansible_become: yes
+ ansible_host: 192.168.98.21
+ ip: 192.168.98.21
+ access_ip: 192.168.98.21
+ worker-02:
+ ansible_user: ubuntu
+ ansible_become: yes
+ ansible_host: 192.168.98.22
+ ip: 192.168.98.22
+ access_ip: 192.168.98.22
+ worker-03:
+ ansible_user: ubuntu
+ ansible_become: yes
+ ansible_host: 192.168.98.23
+ ip: 192.168.98.23
+ access_ip: 192.168.98.23
+ children:
+ kube_control_plane:
+ hosts:
+ master-01: {}
+ master-02: {}
+ master-03: {}
+ kube_node:
+ hosts:
+ worker-01: {}
+ worker-02: {}
+ worker-03: {}
+ etcd:
+ children:
+ kube_control_plane:
+ k8s_cluster:
+ children:
+ kube_control_plane: {}
+ kube_node: {}
+ calico_rr:
+ hosts: {}
diff --git a/ansible/k8s/kubespray/kubespray-repo b/ansible/k8s/kubespray/kubespray-repo
new file mode 160000
index 0000000000000000000000000000000000000000..eeeca4a1d0334efebcf732d08bffc7e10240fc9c
--- /dev/null
+++ b/ansible/k8s/kubespray/kubespray-repo
@@ -0,0 +1 @@
+Subproject commit eeeca4a1d0334efebcf732d08bffc7e10240fc9c
diff --git a/ansible/k8s/requirements.galaxy.yaml b/ansible/k8s/requirements.galaxy.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..facdff493591682702b4a0269c8c77215239bfd0
--- /dev/null
+++ b/ansible/k8s/requirements.galaxy.yaml
@@ -0,0 +1,16 @@
+---
+
+collections:
+ - community.general
+ - community.crypto
+ - ansible.posix
+
+roles:
+ - src: git@git.sch.bme.hu:kszk/ansible/roles/base.git
+ scm: git
+ version: master
+ name: kszk.base
+ - src: git@git.sch.bme.hu:kszk/ansible/roles/iptables.git
+ scm: git
+ version: master
+ name: kszk.iptables
diff --git a/terraform/k8s.tf b/terraform/k8s.tf
new file mode 100644
index 0000000000000000000000000000000000000000..78976747fa60b31edd21b2f7247fca94a882290e
--- /dev/null
+++ b/terraform/k8s.tf
@@ -0,0 +1,79 @@
+locals {
+ vm_map = {
+ master-01 = {
+ number = 11
+ cores = 3
+ memory = 4096
+ disk = "30G"
+ }
+ master-02 = {
+ number = 12
+ cores = 3
+ memory = 4096
+ disk = "30G"
+ }
+ master-03 = {
+ number = 13
+ cores = 3
+ memory = 4096
+ disk = "30G"
+ }
+ worker-01 = {
+ number = 21
+ cores = 4
+ memory = 6144
+ disk = "40G"
+ }
+ worker-02 = {
+ number = 22
+ cores = 4
+ memory = 6144
+ disk = "40G"
+ }
+ worker-03 = {
+ number = 23
+ cores = 4
+ memory = 6144
+ disk = "40G"
+ }
+ }
+}
+
+resource "proxmox_vm_qemu" "vm" {
+ for_each = { for k, v in local.vm_map : k => v }
+
+ name = each.key
+ desc = "Kubernetes"
+ vmid = "80${each.value.number}"
+
+ target_node = "maze"
+
+ clone = "ubuntu-cloudinit-20.04"
+
+ agent = 1
+
+ cores = each.value.cores
+ sockets = 1
+ vcpus = 0
+ memory = each.value.memory
+
+ os_type = "cloud-init"
+
+ disk {
+ size = each.value.disk
+ type = "virtio"
+ storage = "z-one"
+ }
+
+ network {
+ model = "virtio"
+ bridge = "vmbr0"
+ macaddr = "7A:19:32:CF:F4:${each.value.number}"
+ }
+
+ nameserver = "8.8.8.8"
+ ipconfig0 = "ip=192.168.98.${each.value.number}/22,gw=192.168.99.254"
+ sshkeys = <<-EOT
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPpH+TNAwcmxYc5cVctH04wUU83Pba6s/AkKXOnhDn+m rlacko@zen
+EOT
+}