---
- name: Prepare node for Kubernetes with CRI-O
  hosts: all
  become: true
  tasks:
    - name: Disable and stop firewalld
      ansible.builtin.systemd:
        name: firewalld
        state: stopped
        enabled: false

    - name: Set SELinux to permissive mode in config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        regexp: '^SELINUX='
        line: 'SELINUX=permissive'

    - name: Set SELinux to permissive runtime immediately
      ansible.posix.selinux:
        policy: targeted
        state: permissive

    - name: Configure kernel modules to load on boot
      ansible.builtin.copy:
        dest: /etc/modules-load.d/k8s.conf
        content: |
          overlay
          br_netfilter
        mode: '0644'

    - name: Load kernel modules immediately
      community.general.modprobe:
        name: "{{ item }}"
        state: present
      loop:
        - overlay
        - br_netfilter

    - name: Configure sysctl parameters for Kubernetes networking
      ansible.posix.sysctl:
        name: "{{ item.key }}"
        value: "{{ item.value }}"
        sysctl_file: /etc/sysctl.d/k8s.conf
        state: present
        reload: true
      loop:
        - { key: 'net.bridge.bridge-nf-call-iptables', value: '1' }
        - { key: 'net.bridge.bridge-nf-call-ip6tables', value: '1' }
        - { key: 'net.ipv4.ip_forward', value: '1' }

    - name: Add Kubernetes YUM repository
      ansible.builtin.yum_repository:
        name: kubernetes
        description: Kubernetes
        baseurl: https://pkgs.k8s.io/core:/stable:/v1.37/rpm/
        enabled: true
        gpgcheck: true
        gpgkey: https://pkgs.k8s.io/core:/stable:/v1.37/rpm/repodata/repomd.xml.key

    - name: Add CRI-O YUM repository
      ansible.builtin.yum_repository:
        name: cri-o
        description: CRI-O
        baseurl: https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.37/rpm/
        enabled: true
        gpgcheck: true
        gpgkey: https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.37/rpm/repodata/repomd.xml.key

    - name: Install CRI-O, Podman, and Kubernetes packages
      ansible.builtin.dnf:
        name:
          - cri-o
          - cri-tools
          - podman
          - kubelet
          - kubeadm
          - kubectl
        state: present

    - name: Ensure CRI-O configuration drop-in directory exists
      ansible.builtin.file:
        path: /etc/crio/crio.conf.d
        state: directory
        mode: '0755'

    - name: Configure CRI-O cgroup manager
      ansible.builtin.copy:
        dest: /etc/crio/crio.conf.d/10-cgroup-manager.conf
        content: |
          [crio.runtime]
          conmon_cgroup = "pod"
          cgroup_manager = "systemd"
        mode: '0644'
      notify: Restart crio

    - name: Configure kubelet runtime endpoint
      ansible.builtin.copy:
        dest: /etc/sysconfig/kubelet
        content: |
          KUBELET_EXTRA_ARGS="--container-runtime-endpoint=unix:///var/run/crio/crio.sock"
        mode: '0644'
      notify: Restart kubelet

    - name: Enable and start CRI-O
      ansible.builtin.systemd:
        name: crio
        state: started
        enabled: true
        daemon_reload: true

    - name: Enable and start kubelet
      ansible.builtin.systemd:
        name: kubelet
        state: started
        enabled: true

    - name: Reboot the server
      ansible.builtin.reboot:
        reboot_timeout: 600

  handlers:
    - name: Restart crio
      ansible.builtin.systemd:
        name: crio
        state: restarted

    - name: Restart kubelet
      ansible.builtin.systemd:
        name: kubelet
        state: restarted