fix(ansible): replace deprecated entities and sync version requirements (#478)

      block:

        - name: Verify Ansible meets airgap version requirements.

          ansible.builtin.assert:

            that: "ansible_version.full is version_compare('2.12', '>=')"

            msg: "The Airgap role requires at least ansible-core 2.12"

            that: "ansible_version.full is version_compare('2.15', '>=')"

            msg: "The Airgap role requires at least ansible-core 2.15"

        - name: Check for existing install script

          become: false

        - name: Determine architecture and set airgap_k3s_arch

          ansible.builtin.set_fact:

            airgap_k3s_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'arm' if ansible_architecture == 'armv7l' else 'amd64' }}"

            airgap_k3s_arch: "{{ 'arm64' if ansible_facts['architecture'] == 'aarch64' else 'arm' if ansible_facts['architecture'] == 'armv7l' else 'amd64' }}"

        - name: Distribute K3s binary

          ansible.builtin.copy:

        - name: Install K3s SELinux RPM

          when:

            - ansible_os_family == 'RedHat'

            - ansible_facts['os_family'] == 'RedHat'

            - airgap_selinux_copy.skipped is false

          ansible.builtin.dnf:

            name: "{{ airgap_selinux_copy.results[0].dest }}"

  ansible.builtin.lineinfile:

    path: "{{ systemd_dir }}/k3s-agent.service.env"

    line: "{{ item }}"

  with_items: "{{ extra_service_envs }}"

  loop: "{{ extra_service_envs }}"

- name: Delete any existing token from the environment if different from the new one

  ansible.builtin.lineinfile:

  ansible.builtin.lineinfile:

    path: "{{ systemd_dir }}/k3s-agent.service.env"

    line: "{{ item }}"

  with_items:

  loop:

    - "K3S_TOKEN={{ token }}"

- name: Modify ExecStart in k3s-agent.service to include API endpoint and extra args

      ansible.builtin.lineinfile:

        path: "{{ systemd_dir }}/k3s.service.env"

        line: "{{ item }}"

      with_items: "{{ extra_service_envs }}"

      loop: "{{ extra_service_envs }}"

    - name: Delete any existing token from the environment if different from the new one

      ansible.builtin.lineinfile:

      ansible.builtin.lineinfile:

        path: "{{ systemd_dir }}/k3s.service.env"

        line: "{{ item }}"

      with_items: "{{ extra_service_envs }}"

      loop: "{{ extra_service_envs }}"

    - name: Delete any existing token from the environment if different from the new one

      ansible.builtin.lineinfile:

      ansible.builtin.lineinfile:

        path: "{{ systemd_dir }}/k3s.service.env"

        line: "{{ item }}"

      with_items:

      loop:

        - "K3S_TOKEN={{ token }}"

    # When using an external database, no join is needed, instead, users should be

- name: Enforce minimum Ansible version

  ansible.builtin.assert:

    that:

      - ansible_version.full is version('2.14', '>=')

    msg: "Minimum ansible-core version required is 2.14"

      - ansible_version.full is version('2.15', '>=')

    msg: "Minimum ansible-core version required is 2.15"

- name: Install Dependent Ubuntu Packages

  when: ansible_distribution in ['Ubuntu']

  when: ansible_facts['distribution'] in ['Ubuntu']

  ansible.builtin.apt:

    name: policycoreutils  # Used by install script to restore SELinux context

    update_cache: "{{ airgap_dir is not defined }}"

- name: Install Dependent RHEL 10 Package

  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version == "10"

  when: ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == "10"

  ansible.builtin.dnf:

    name: kernel-modules-extra   # Load br_netfilter module

    update_cache: "{{ airgap_dir is not defined }}"

    value: "1"

    state: present

    reload: true

  when: ansible_all_ipv6_addresses | length > 0

  when: ansible_facts['all_ipv6_addresses'] | length > 0

- name: Populate service facts

  ansible.builtin.service_facts:

        state: enabled

        permanent: true

        immediate: true

      with_items:

      loop:

        - 5001/tcp   # Spegel (Embedded distributed registry)

        - 8472/udp   # Flannel VXLAN

        - 10250/tcp  # Kubelet metrics

            + groups[agent_group] | default([])

          )

          | map('extract', hostvars)

          | selectattr('ansible_default_ipv4', 'defined')

          | map(attribute='ansible_default_ipv4.address')

          | selectattr('ansible_facts.default_ipv4', 'defined')

          | map(attribute='ansible_facts.default_ipv4.address')

          | flatten | unique | list

        }}

    content: "br_netfilter"

    dest: /etc/modules-load.d/br_netfilter.conf

    mode: "u=rw,g=,o="

  when: (ansible_os_family == 'RedHat' or ansible_distribution == 'Archlinux')

  when: (ansible_facts['os_family'] == 'RedHat' or ansible_facts['distribution'] == 'Archlinux')

- name: Load br_netfilter

  community.general.modprobe:

    name: br_netfilter

    state: present

  when: (ansible_os_family == 'RedHat' or ansible_distribution == 'Archlinux')

  when: (ansible_facts['os_family'] == 'RedHat' or ansible_facts['distribution'] == 'Archlinux')

- name: Set bridge-nf-call-iptables (just to be sure)

  ansible.posix.sysctl:

    value: "1"

    state: present

    reload: true

  when: (ansible_os_family == 'RedHat' or ansible_distribution == 'Archlinux')

  when: (ansible_facts['os_family'] == 'RedHat' or ansible_facts['distribution'] == 'Archlinux')

  loop:

    - net.bridge.bridge-nf-call-iptables

    - net.bridge.bridge-nf-call-ip6tables

- name: Install Apparmor Parser [Suse]

  when:

    - ansible_os_family == 'Suse'

    - ansible_facts['os_family'] == 'Suse'

    - prereq_apparmor_status is defined

    - prereq_apparmor_status.stdout == "Y"

  ansible.builtin.package:

- name: Install Apparmor Parser [Debian]

  when:

    - ansible_distribution == 'Debian'

    - ansible_facts['distribution'] == 'Debian'

    - ansible_facts['distribution_major_version'] == "11"

    - prereq_apparmor_status is defined

    - prereq_apparmor_status.stdout == "Y"

    insertafter: EOF

    path: /etc/sudoers

    validate: 'visudo -cf %s'

  when: ansible_os_family == 'RedHat'

  when: ansible_facts['os_family'] == 'RedHat'

- name: Setup alternative K3s directory

  when:

      ansible.builtin.include_tasks: "{{ item }}"

      with_first_found:

        - "prereq/{{ detected_distribution }}.yml"

        - "prereq/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml"

        - "prereq/{{ ansible_distribution }}.yml"

        - "prereq/{{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_major_version'] }}.yml"

        - "prereq/{{ ansible_facts['distribution'] }}.yml"

        - "prereq/default.yml"