diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 5274869..d55ef33 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -9,8 +9,16 @@ repos:
         args:
           - --autofix
       - id: trailing-whitespace
+  - repo: https://github.com/google/yamlfmt
+    rev: v0.21.0
+    hooks:
+      - id: yamlfmt
   - repo: https://github.com/tofuutils/pre-commit-opentofu
     rev: v2.4.2
     hooks:
       - id: tofu_validate
       - id: tofu_fmt
+  - repo: https://github.com/ansible/ansible-lint
+    rev: v26.4.0
+    hooks:
+      - id: ansible-lint
diff --git a/ansible/group_vars/all.yaml b/ansible/group_vars/all.yaml
index e425179..f1a3ed4 100644
--- a/ansible/group_vars/all.yaml
+++ b/ansible/group_vars/all.yaml
@@ -1,2 +1 @@
----
 ansible_python_interpreter: /usr/bin/python3
diff --git a/ansible/inventories/incus/incus.yaml b/ansible/inventories/incus/incus.yaml
index 8fe7d5b..9e178f4 100644
--- a/ansible/inventories/incus/incus.yaml
+++ b/ansible/inventories/incus/incus.yaml
@@ -1,4 +1,3 @@
----
 plugin: community.general.incus
 strict: true
 remotes:
diff --git a/ansible/playbooks/master-playbook.yaml b/ansible/playbooks/master-playbook.yaml
index 8733958..c0d3203 100644
--- a/ansible/playbooks/master-playbook.yaml
+++ b/ansible/playbooks/master-playbook.yaml
@@ -3,10 +3,7 @@
   tasks:
     - name: Initialise high-availability Kubernetes cluster
       ansible.builtin.command: >-
-        kubeadm init
-        --pod-network-cidr="172.16.0.0/16"
-        --control-plane-endpoint="{{ ansible_default_ipv4.address }}:6443"
-        --upload-certs
+        kubeadm init --pod-network-cidr="172.16.0.0/16" --control-plane-endpoint="{{ ansible_default_ipv4.address }}:6443" --upload-certs
       args:
         creates: /etc/kubernetes/admin.conf
     - name: Copy Kubernetes Admin Config
@@ -17,13 +14,11 @@
         - chown $(id -u):$(id -g) $HOME/.kube/config
       args:
         creates: $HOME/.kube/config
-
     - name: Install Pod Network (Calico)
       ansible.builtin.shell: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml > pod_network_setup.txt
       args:
         chdir: $HOME
         creates: pod_network_setup.txt
-
     - name: Add Helm repositories
       kubernetes.core.helm_repository:
         name: "{{ item.name }}"
@@ -39,7 +34,6 @@
           url: https://traefik.github.io/charts
         - name: minecraft-server-charts
           url: https://itzg.github.io/minecraft-server-charts/
-
     - name: Install Metrics Server
       kubernetes.core.helm:
         release_name: metrics-server
@@ -49,7 +43,6 @@
         values:
           args:
             - --kubelet-insecure-tls
-
     - name: Install Longhorn
       kubernetes.core.helm:
         release_name: longhorn
@@ -57,7 +50,6 @@
         create_namespace: true
         chart_ref: longhorn/longhorn
         chart_version: 1.12.0
-
     - name: Install Prometheus
       kubernetes.core.helm:
         release_name: prometheus
@@ -66,7 +58,6 @@
         chart_ref: prometheus-community/prometheus
         chart_version: 29.10.0
         state: absent
-
     - name: Install Traefik
       kubernetes.core.helm:
         release_name: traefik
@@ -92,7 +83,6 @@
               port: 443
               containerPort: 443
               hostPort: 443
-
     - name: Install Minecraft
       kubernetes.core.helm:
         release_name: minecraft
@@ -105,25 +95,20 @@
           persistence:
             dataDir:
               enabled: true
-
     - name: Extract Control Plane Decryption Key & Join Token
       block:
         - name: Generate Fresh Join Command
           ansible.builtin.command: kubeadm token create --print-join-command
           register: join_command_raw
-
         - name: Upload Certs and Capture Certificate Key
           shell: kubeadm init phase upload-certs --upload-certs | tail -n 1
           register: cert_key_raw
-
         - name: Set facts across playbooks
           ansible.builtin.set_fact:
             k8s_join_base: "{{ join_command_raw.stdout }}"
             k8s_cert_key: "{{ cert_key_raw.stdout }}"
           delegate_to: localhost
           delegate_facts: true
-
-
 - name: Join Secondary Control Planes
   hosts: masters:!masters[0] # <--- Targets masters 1 and 2
   tasks:
@@ -131,7 +116,6 @@
       ansible.builtin.shell: "{{ hostvars['localhost']['k8s_join_base'] }} --control-plane --certificate-key {{ hostvars['localhost']['k8s_cert_key'] }}"
       args:
         creates: /etc/kubernetes/admin.conf
-
     - name: Copy Kubernetes Admin Config
       ansible.builtin.shell: "{{ item }}"
       loop:
@@ -140,7 +124,6 @@
         - chown $(id -u):$(id -g) $HOME/.kube/config
       args:
         creates: $HOME/.kube/config
-
 - name: Remove control plane taint
   hosts: masters[0]
   tasks:
diff --git a/ansible/playbooks/setup-playbook.yaml b/ansible/playbooks/setup-playbook.yaml
index ff10fd6..7f3c32a 100644
--- a/ansible/playbooks/setup-playbook.yaml
+++ b/ansible/playbooks/setup-playbook.yaml
@@ -6,7 +6,6 @@
         name: net.ipv4.ip_forward
         value: 1
         sysctl_set: true
-
     - name: Enable Kernel Modules
       community.general.modprobe:
         name: "{{ item }}"
@@ -14,7 +13,6 @@
       loop:
         - br_netfilter
         - dm-crypt
-
     - name: Ensure /sys mount is set to shared for container runtimes
       block:
         - name: Remount /sys as shared immediately
@@ -24,7 +22,6 @@
             - /sys
             - /run
           changed_when: false
-
         - name: Create Alpine local.d script for permanent shared mount
           ansible.builtin.copy:
             dest: /etc/local.d/mount-shared.start
@@ -36,20 +33,17 @@
             owner: root
             group: root
             mode: '0755'
-
         - name: Ensure Alpine local service is enabled on boot
           ansible.builtin.service:
             name: local
             enabled: true
             runlevel: default
-
     - name: Install tools
       ansible.builtin.package:
         name: "{{ item }}"
         state: present
       loop:
         - htop
-
     - name: Install kubectl, kubelet, kubeadm and containerd
       ansible.builtin.package:
         name: "{{ item }}"
@@ -62,7 +56,6 @@
         - cni-plugins
         - helm
         - open-iscsi
-
     - name: Start kubelet and containerd
       ansible.builtin.service:
         name: "{{ item }}"
@@ -72,14 +65,12 @@
         - kubelet
         - containerd
         - iscsid
-
     - name: Add /opt/cni/bin to containerd CNI binary directories
       ansible.builtin.replace:
         path: /etc/containerd/config.toml
         regexp: "bin_dirs = \\['/usr/libexec/cni'\\]"
         replace: "bin_dirs = ['/opt/cni/bin', '/usr/libexec/cni']"
       notify: Restart containerd
-
   handlers:
     - name: Restart containerd
       ansible.builtin.service:
diff --git a/ansible/playbooks/worker-playbook.yaml b/ansible/playbooks/worker-playbook.yaml
index 9bb4099..e30e82a 100644
--- a/ansible/playbooks/worker-playbook.yaml
+++ b/ansible/playbooks/worker-playbook.yaml
@@ -6,13 +6,11 @@
       ansible.builtin.command: kubeadm token create --print-join-command
       register: join_command_raw
       changed_when: false # Reading/generating a token text string changes no host state
-
     - name: Save join command globally
       ansible.builtin.set_fact:
         k8s_worker_join: "{{ join_command_raw.stdout }}"
       delegate_to: localhost
       delegate_facts: true
-
 - name: Join Worker Nodes to Cluster
   hosts: workers
   gather_facts: false
diff --git a/ansible/roles/common/tasks/main.yaml b/ansible/roles/common/tasks/main.yaml
index 7271e9b..478e1fe 100644
--- a/ansible/roles/common/tasks/main.yaml
+++ b/ansible/roles/common/tasks/main.yaml
@@ -1,3 +1,2 @@
----
 - name: Install required packages
   ansible.builtin.import_tasks: packages.yaml
diff --git a/ansible/roles/common/tasks/packages.yaml b/ansible/roles/common/tasks/packages.yaml
index 45b7e97..e9fa22b 100644
--- a/ansible/roles/common/tasks/packages.yaml
+++ b/ansible/roles/common/tasks/packages.yaml
@@ -1,4 +1,3 @@
----
 - name: Install Python 3 Dependencies
   ansible.builtin.apt:
     pkg:
diff --git a/ansible/roles/kubernetes_master/tasks/main.yaml b/ansible/roles/kubernetes_master/tasks/main.yaml
new file mode 100644
index 0000000..7341571
--- /dev/null
+++ b/ansible/roles/kubernetes_master/tasks/main.yaml
@@ -0,0 +1,24 @@
+---
+- name: Initialise high-availability Kubernetes cluster
+  ansible.builtin.command: >-
+    kubeadm init
+    --pod-network-cidr="172.16.0.0/16"
+    --control-plane-endpoint="{{ ansible_default_ipv4.address }}:6443"
+    --upload-certs
+  args:
+    creates: /etc/kubernetes/admin.conf
+
+- name: Copy Kubernetes Admin Config
+  ansible.builtin.command: "{{ item }}"
+  loop:
+    - mkdir -p $HOME/.kube
+    - cp /etc/kubernetes/admin.conf $HOME/.kube/config
+    - chown $(id -u):$(id -g) $HOME/.kube/config
+  args:
+    creates: $HOME/.kube/config
+
+- name: Install Pod Network (Calico)
+  ansible.builtin.shell: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.32.0/manifests/calico.yaml > pod_network_setup.txt
+  args:
+    chdir: $HOME
+    creates: pod_network_setup.txt
diff --git a/ansible/roles/kubernetes_node/tasks/main.yaml b/ansible/roles/kubernetes_node/tasks/main.yaml
index e00bbd5..0b7a185 100644
--- a/ansible/roles/kubernetes_node/tasks/main.yaml
+++ b/ansible/roles/kubernetes_node/tasks/main.yaml
@@ -1,9 +1,6 @@
----
 - name: Install Kubernetes APT repository
   ansible.builtin.import_tasks: repo.yaml
-
 - name: Install Kubernetes packages
   ansible.builtin.import_tasks: packages.yaml
-
 - name: Configure networking
   ansible.builtin.import_tasks: networking.yaml
diff --git a/ansible/roles/kubernetes_node/tasks/networking.yaml b/ansible/roles/kubernetes_node/tasks/networking.yaml
index 8e7488a..12369f2 100644
--- a/ansible/roles/kubernetes_node/tasks/networking.yaml
+++ b/ansible/roles/kubernetes_node/tasks/networking.yaml
@@ -1,4 +1,3 @@
----
 - name: Enable sysctl 'net.ipv4.ip_forward'
   ansible.posix.sysctl:
     name: net.ipv4.ip_forward
diff --git a/ansible/roles/kubernetes_node/tasks/packages.yaml b/ansible/roles/kubernetes_node/tasks/packages.yaml
index 5bf2e75..014d286 100644
--- a/ansible/roles/kubernetes_node/tasks/packages.yaml
+++ b/ansible/roles/kubernetes_node/tasks/packages.yaml
@@ -1,4 +1,3 @@
----
 - name: Install Kubernetes packages
   ansible.builtin.apt:
     pkg:
@@ -6,7 +5,6 @@
       - kubelet
       - containerd
     update_cache: true
-
 - name: Activate containerd service
   ansible.builtin.service:
     name: containerd
diff --git a/ansible/roles/kubernetes_node/tasks/repo.yaml b/ansible/roles/kubernetes_node/tasks/repo.yaml
index 9ba0790..95909ee 100644
--- a/ansible/roles/kubernetes_node/tasks/repo.yaml
+++ b/ansible/roles/kubernetes_node/tasks/repo.yaml
@@ -1,4 +1,3 @@
----
 - name: Add Kubernetes APT repository
   ansible.builtin.deb822_repository:
     name: kubernetes
diff --git a/ansible/site.yaml b/ansible/site.yaml
index 6b3645e..00c7f87 100644
--- a/ansible/site.yaml
+++ b/ansible/site.yaml
@@ -1,10 +1,9 @@
----
 - name: Bootstrap
   hosts: all
   roles:
     - common
-
-- name: Setup Kubernetes nodes
-  hosts: all
+- name: Setup Kubernetes masters
+  hosts: masters
   roles:
     - kubernetes_node
+    - kubernetes_master