feat(networking): install and configure wireguard encryption

by default set to false.

!2 #3

tasks/k3s.yaml

@@ -17,3 +17,14 @@
     install_kubernetes | default(true) | bool
       and
     not kubernetes_installed | default(false) | bool
+
+
+- name: Wireguard Cluster Encryption
+  ansible.builtin.include_tasks:
+    file: k3s/configure.yaml
+  when: >
+    install_kubernetes | default(true) | bool
+      and
+    not kubernetes_installed | default(false) | bool
+      and
+    not kubernetes_installed_encryption | default(false) | bool

tasks/k3s/wireguard.yaml

@@ -0,0 +1,26 @@
+---
+- name: Install Wireguard
+  ansible.builtin.apt:
+    name:
+      - wireguard
+    update_cache: false
+  when: >
+    ansible_os_family == 'Debian'
+      and
+    kubernetes.networking.encrypt | default(false) | bool
+
+
+- name: Enable Cluster Encryption
+  ansible.builtin.command:
+    cmd: kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'
+  changed_when: false
+  when: >
+    ansible_os_family == 'Debian'
+      and
+    kubernetes.networking.encrypt | default(false) | bool
+      and
+    kubernetes_config.cluster.prime.name == inventory_hostname
+
+- name: Set Kubernetes Encryption Final Install Fact
+  ansible.builtin.set_fact:
+    kubernetes_installed_encryption: true