---
# Remove requiretty to make ssh pipelining work
- name: Remove require tty
  lineinfile:
    regexp: '^\w+\s+requiretty'
    path: /etc/sudoers
    state: absent

# Disable swap
- name: Remove swapfile from /etc/fstab
  mount:
    name: swap
    fstype: swap
    state: absent
  when: disable_swap

- name: Disable swap
  command: swapoff -a
  when:
  - disable_swap
  - ansible_swaptotal_mb > 0

# Set SELinux policy
- name: Confirm SELinux deployed
  stat:
    path: /etc/selinux/config
  when: ansible_os_family == "RedHat"
  register: slc

- name: Set selinux policy
  selinux:
    policy: targeted
    state: permissive
  when:
  - ansible_os_family == "RedHat"
  - slc.stat.exists == True
  - ansible_selinux.status == "enabled"
  changed_when: False

- name: Stat sysctl file configuration
  stat:
    path: "{{ sysctl_file_path }}"
  register: sysctl_file_stat

- name: Change sysctl file path to link source if linked
  set_fact:
    sysctl_file_path: "{{ sysctl_file_stat.stat.lnk_source }}"
  when:
  - sysctl_file_stat.stat.islnk is defined
  - sysctl_file_stat.stat.islnk

- name: Setting kernel params
  sysctl:
    sysctl_file: "{{ sysctl_file_path }}"
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
    reload: yes
  with_items:
  - { name: 'net.core.somaxconn', value: 32768 }
  - { name: 'vm.swappiness', value: 0 }
  - { name: 'net.ipv4.tcp_syncookies', value: 0 }
  - { name: 'net.ipv4.ip_forward', value: 1 }
  - { name: 'fs.file-max', value: 1000000 }
  - { name: 'fs.inotify.max_user_watches', value: 1048576 }
  - { name: 'net.ipv4.neigh.default.gc_thresh1', value: 80000 }
  - { name: 'net.ipv4.neigh.default.gc_thresh2', value: 90000 }
  - { name: 'net.ipv4.neigh.default.gc_thresh3', value: 100000 }

- name: Ensure nodePort range is reserved
  sysctl:
    name: net.ipv4.ip_local_reserved_ports
    value: "{{ kube_apiserver_node_port_range }}"
    sysctl_set: yes
    sysctl_file: "{{ sysctl_file_path }}"
    state: present
    reload: yes
  when: kube_apiserver_node_port_range is defined

- name: Update /etc/security/limits.conf
  blockinfile:
    dest: /etc/security/limits.conf
    insertafter: EOF
    block: |
      root        soft        nofile        1000000
      root        hard        nofile        1000000
      root        soft        stack         10240

- name: Enable irqbalance service
  service: name=irqbalance state=started
  ignore_errors: true
  when: irqbalance_enabled

- name: Verify if br_netfilter module exists
  shell: "modinfo br_netfilter"
  environment:
    PATH: "{{ ansible_env.PATH}}:/sbin"  # Make sure we can workaround RH's conservative path management
  register: modinfo_br_netfilter
  failed_when: modinfo_br_netfilter.rc not in [0, 1]
  changed_when: false

- name: Enable br_netfilter module
  modprobe:
    name: br_netfilter
    state: present
  when: modinfo_br_netfilter.rc == 0

- name: Persist br_netfilter module
  copy:
    dest: /etc/modules-load.d/kubespray-br_netfilter.conf
    content: br_netfilter
  when: modinfo_br_netfilter.rc == 0

# kube-proxy needs net.bridge.bridge-nf-call-iptables enabled when found if br_netfilter is not a module
- name: Check if bridge-nf-call-iptables key exists
  command: "sysctl net.bridge.bridge-nf-call-iptables"
  failed_when: false
  changed_when: false
  register: sysctl_bridge_nf_call_iptables

- name: Enable bridge-nf-call tables
  sysctl:
    name: "{{ item }}"
    state: present
    sysctl_file: "{{ sysctl_file_path }}"
    value: 1
    reload: yes
  with_items:
  - net.bridge.bridge-nf-call-iptables
  - net.bridge.bridge-nf-call-arptables
  - net.bridge.bridge-nf-call-ip6tables
  when: sysctl_bridge_nf_call_iptables.rc == 0