From 068659e174508f2d3a405127858fd6b8ce1d4645 Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Tue, 30 Jun 2026 23:39:34 +0100
Subject: [PATCH] refactor: split control plane role into init/join/copy tasks

---
 .../tasks/cilium.yaml                         | 12 ----
 .../tasks/copy-config.yaml                    |  5 +-
 .../tasks/init-cluster.yaml                   | 21 +++++++
 .../tasks/join-cluster.yaml                   | 20 ++++++
 .../tasks/kube-vip.yaml                       |  2 +-
 .../tasks/longhorn.yaml                       | 13 ----
 .../kubernetes_control_plane/tasks/main.yaml  | 62 ++-----------------
 .../kubernetes_control_plane/tasks/tools.yaml | 18 ------
 .../tasks/untaint.yaml                        |  7 ---
 .../templates/kubeadm-config.yaml.j2          |  5 +-
 10 files changed, 54 insertions(+), 111 deletions(-)
 delete mode 100644 ansible/roles/kubernetes_control_plane/tasks/cilium.yaml
 create mode 100644 ansible/roles/kubernetes_control_plane/tasks/init-cluster.yaml
 create mode 100644 ansible/roles/kubernetes_control_plane/tasks/join-cluster.yaml
 delete mode 100644 ansible/roles/kubernetes_control_plane/tasks/longhorn.yaml
 delete mode 100644 ansible/roles/kubernetes_control_plane/tasks/tools.yaml
 delete mode 100644 ansible/roles/kubernetes_control_plane/tasks/untaint.yaml

diff --git a/ansible/roles/kubernetes_control_plane/tasks/cilium.yaml b/ansible/roles/kubernetes_control_plane/tasks/cilium.yaml
deleted file mode 100644
index 63a9c83..0000000
--- a/ansible/roles/kubernetes_control_plane/tasks/cilium.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-- name: Ensure Cilium repository exists
-  kubernetes.core.helm_repository:
-    name: cilium
-    url: https://helm.cilium.io/
-
-- name: Ensure Cilium is installed
-  kubernetes.core.helm:
-    release_name: cilium
-    release_namespace: kube-system
-    chart_ref: cilium/cilium
-    chart_version: 1.19.5
-  run_once: true
diff --git a/ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml b/ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml
index caecd22..48afc07 100644
--- a/ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml
+++ b/ansible/roles/kubernetes_control_plane/tasks/copy-config.yaml
@@ -1,4 +1,5 @@
-- name: Copy Kubernetes Admin configuration
+- name: Setup Kubernetes admin config for root user
+  become: true
   block:
     - name: Ensure .kube directory
       ansible.builtin.file:
@@ -7,7 +8,7 @@
         owner: "{{ ansible_facts['user_id'] }}"
         group: "{{ ansible_facts['user_id'] }}"
         mode: "0755"
-    - name: Copy Admin configuration
+    - name: Copy admin configuration
       ansible.builtin.copy:
         src: /etc/kubernetes/admin.conf
         dest: "{{ ansible_facts['env']['HOME'] }}/.kube/config"
diff --git a/ansible/roles/kubernetes_control_plane/tasks/init-cluster.yaml b/ansible/roles/kubernetes_control_plane/tasks/init-cluster.yaml
new file mode 100644
index 0000000..b40efe3
--- /dev/null
+++ b/ansible/roles/kubernetes_control_plane/tasks/init-cluster.yaml
@@ -0,0 +1,21 @@
+- name: Check if cluster is initialised
+  ansible.builtin.stat:
+    path: /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_admin_conf
+  run_once: true
+
+- name: Initialise Kubernetes cluster
+  when: not kubernetes_control_plane_admin_conf.stat.exists
+  block:
+    - name: Copy kubeadm config
+      ansible.builtin.template:
+        src: kubeadm-config.yaml.j2
+        dest: /tmp/kubeadm-config.yaml
+        mode: "0600"
+      run_once: true
+
+    - name: Initialise Kubernetes with kubeadm
+      ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
+      args:
+        creates: /etc/kubernetes/admin.conf
+      run_once: true
diff --git a/ansible/roles/kubernetes_control_plane/tasks/join-cluster.yaml b/ansible/roles/kubernetes_control_plane/tasks/join-cluster.yaml
new file mode 100644
index 0000000..810fcc3
--- /dev/null
+++ b/ansible/roles/kubernetes_control_plane/tasks/join-cluster.yaml
@@ -0,0 +1,20 @@
+- name: Generate join command
+  ansible.builtin.command: kubeadm token create --print-join-command --kubeconfig /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_join_command
+  run_once: true
+  changed_when: false
+
+- name: Get certificate key
+  ansible.builtin.command: kubeadm init phase upload-certs --upload-certs --kubeconfig /etc/kubernetes/admin.conf
+  register: kubernetes_control_plane_certificate_key
+  run_once: true
+  changed_when: false
+
+- name: Join additional control planes
+  ansible.builtin.command: >-
+    {{ kubernetes_control_plane_join_command.stdout }}
+    --control-plane
+    --certificate-key
+    {{ kubernetes_control_plane_certificate_key.stdout_lines[-1] }}
+  args:
+    creates: /etc/kubernetes/admin.conf
diff --git a/ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml b/ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml
index 1e501bc..24a96c3 100644
--- a/ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml
+++ b/ansible/roles/kubernetes_control_plane/tasks/kube-vip.yaml
@@ -1,4 +1,4 @@
-- name: Ensure kube-vip static pod
+- name: Ensure kube-vip static pod manifest exists
   ansible.builtin.template:
     src: kube-vip.yaml.j2
     dest: /etc/kubernetes/manifests/kube-vip.yaml
diff --git a/ansible/roles/kubernetes_control_plane/tasks/longhorn.yaml b/ansible/roles/kubernetes_control_plane/tasks/longhorn.yaml
deleted file mode 100644
index 4093402..0000000
--- a/ansible/roles/kubernetes_control_plane/tasks/longhorn.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-- name: Ensure Longhorn repository exists
-  kubernetes.core.helm_repository:
-    name: longhorn
-    url: https://charts.longhorn.io
-
-- name: Ensure Longhorn is installed
-  kubernetes.core.helm:
-    release_name: longhorn
-    release_namespace: longhorn-system
-    chart_ref: longhorn/longhorn
-    chart_version: 1.12.0
-    create_namespace: true
-  run_once: true
diff --git a/ansible/roles/kubernetes_control_plane/tasks/main.yaml b/ansible/roles/kubernetes_control_plane/tasks/main.yaml
index 12bf677..1810a47 100644
--- a/ansible/roles/kubernetes_control_plane/tasks/main.yaml
+++ b/ansible/roles/kubernetes_control_plane/tasks/main.yaml
@@ -1,63 +1,11 @@
-- name: Install kube-vip static pod
+- name: Configure kube-vip static pod manifest
   ansible.builtin.import_tasks: kube-vip.yaml
 
-- name: Copy kubeadm config
-  ansible.builtin.template:
-    src: kubeadm-config.yaml.j2
-    dest: /tmp/kubeadm-config.yaml
-    mode: "0600"
-
 - name: Initialise Kubernetes cluster
-  ansible.builtin.command: kubeadm init --config /tmp/kubeadm-config.yaml
-  args:
-    creates: /etc/kubernetes/admin.conf
-  run_once: true
+  ansible.builtin.include_tasks: init-cluster.yaml
 
+- name: Join nodes as control planes
+  ansible.builtin.include_tasks: join-cluster.yaml
 
-- name: Copy Kubernetes Admin Configuration
+- name: Copy Kubernetes admin configuration on all nodes
   ansible.builtin.include_tasks: copy-config.yaml
-  run_once: true
-
-
-- name: Generate Join Command
-  ansible.builtin.command: kubeadm token create --print-join-command
-  register: kubernetes_control_plane_join_command
-  run_once: true
-  changed_when: true
-
-
-- name: Get Certificate Key
-  ansible.builtin.shell: set -o pipefail && kubeadm init phase upload-certs --upload-certs | tail -n 1
-  register: kubernetes_control_plane_certificate_key
-  run_once: true
-  changed_when: true
-
-
-- name: Join Additional Control Planes
-  ansible.builtin.command: >-
-    {{ kubernetes_control_plane_join_command.stdout }}
-    --control-plane
-    --certificate-key
-    {{ kubernetes_control_plane_certificate_key.stdout }}
-  args:
-    creates: /etc/kubernetes/admin.conf
-
-
-- name: Copy Kubernetes Admin Configuration
-  ansible.builtin.include_tasks: copy-config.yaml
-
-
-- name: Untaint control planes
-  ansible.builtin.import_tasks: untaint.yaml
-
-
-- name: Install Tools
-  ansible.builtin.import_tasks: tools.yaml
-
-
-- name: Install Cilium CNI
-  ansible.builtin.import_tasks: cilium.yaml
-
-
-# - name: Install Longhorn CSI
-#   ansible.builtin.import_tasks: longhorn.yaml
diff --git a/ansible/roles/kubernetes_control_plane/tasks/tools.yaml b/ansible/roles/kubernetes_control_plane/tasks/tools.yaml
deleted file mode 100644
index 999ca3a..0000000
--- a/ansible/roles/kubernetes_control_plane/tasks/tools.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-- name: Add Helm APT repository
-  ansible.builtin.deb822_repository:
-    name: helm
-    types: deb
-    uris: https://packages.buildkite.com/helm-linux/helm-debian/any/
-    suites: any
-    components: main
-    signed_by: https://packages.buildkite.com/helm-linux/helm-debian/gpgkey
-    state: present
-
-
-- name: Install Kubernetes Tools
-  ansible.builtin.apt:
-    pkg:
-      - kubectl
-      - helm
-    state: present
-    update_cache: true
diff --git a/ansible/roles/kubernetes_control_plane/tasks/untaint.yaml b/ansible/roles/kubernetes_control_plane/tasks/untaint.yaml
deleted file mode 100644
index 3cd04be..0000000
--- a/ansible/roles/kubernetes_control_plane/tasks/untaint.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-- name: Remove control plane NoSchedule taint from all nodes
-  kubernetes.core.k8s_taint:
-    state: absent
-    name: "{{ inventory_hostname_short }}"
-    taints:
-      - key: node-role.kubernetes.io/control-plane
-        effect: NoSchedule
diff --git a/ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2 b/ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2
index e1e3069..d3abaa3 100644
--- a/ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2
+++ b/ansible/roles/kubernetes_control_plane/templates/kubeadm-config.yaml.j2
@@ -6,10 +6,13 @@ apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 clusterName: aeon
 controlPlaneEndpoint: "{{ vip_address }}"
+networking:
+  podSubnet: "{{ cluster_pod_subnet }}"
+  serviceSubnet: "{{ cluster_service_subnet }}"
 ---
 apiVersion: kubelet.config.k8s.io/v1beta1
 kind: KubeletConfiguration
 cgroupDriver: systemd
 failSwapOn: false
 memorySwap:
-  swapBehaviour: LimitedSwap
+  swapBehavior: LimitedSwap