feat(networking): install and configure wireguard encryption

by default set to false.

!2 #3

defaults/main.yml

@@ -117,6 +117,7 @@ k3s:
 #       name: k3s-prod                  # Mandatory, String. Ansible inventory_host that will
 #                                       # act as the prime master node.
 #     networking:
+#       encrypt: true                   # Optional, Boolean. default `false`. Install wireguard for inter-node encryption
 #       podSubnet: 172.16.70.0/24       # Mandatory, String. CIDR
 #       ServiceSubnet: 172.16.72.0/24   # Mandatory, String. CIDR
 #                                       # Mandatory, String. Token to join nodes to the cluster

tasks/k3s.yaml

@@ -17,3 +17,14 @@
     install_kubernetes | default(true) | bool
       and
     not kubernetes_installed | default(false) | bool
+
+
+- name: Wireguard Cluster Encryption
+  ansible.builtin.include_tasks:
+    file: k3s/configure.yaml
+  when: >
+    install_kubernetes | default(true) | bool
+      and
+    not kubernetes_installed | default(false) | bool
+      and
+    not kubernetes_installed_encryption | default(false) | bool

tasks/k3s/wireguard.yaml

@@ -0,0 +1,26 @@
+---
+- name: Install Wireguard
+  ansible.builtin.apt:
+    name:
+      - wireguard
+    update_cache: false
+  when: >
+    ansible_os_family == 'Debian'
+      and
+    kubernetes.networking.encrypt | default(false) | bool
+
+
+- name: Enable Cluster Encryption
+  ansible.builtin.command:
+    cmd: kubectl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true,"wireguardEnabledV6":true}}'
+  changed_when: false
+  when: >
+    ansible_os_family == 'Debian'
+      and
+    kubernetes.networking.encrypt | default(false) | bool
+      and
+    kubernetes_config.cluster.prime.name == inventory_hostname
+
+- name: Set Kubernetes Encryption Final Install Fact
+  ansible.builtin.set_fact:
+    kubernetes_installed_encryption: true