Ansible Playbooks

Turkish README: README.tr.md

A collection of Ansible playbooks for health checks, reporting, and maintenance of Kubernetes clusters and servers.

Full usage guides for every playbook are on GitHub Pages. Documentation is English by default; Turkish lives in docs/tr/ and on GitHub Pages via the Türkçe language switch.

Installation

OS-specific install steps: docs/00_installation.md

Quick start:

ansible-playbook -i inventories-example/musteri_a/hosts.ini playbooks/01_check_pod_health.yml

Structure

playbooks/           Playbook files (01-53, numbered)
playbooks/tasks/     Shared/reusable task lists (called via import_tasks)
playbooks/files/     Static scripts and config files copied to target hosts
inventories-example/ Example inventory files (musteri_a is included as a sample)
inventories/         Real environment inventories (all gitignored)
docs/                Per-playbook usage guides (English by default; numbers match playbooks)
docs/tr/             Turkish translations of the same guides

Playbooks

#	Playbook	Description	Read-only?
00	—	Installation instructions	—
01	check_pod_health	Kubernetes pod health	✅
02	check_open_nodeports	Finds open NodePorts and produces browser links	✅
03	check_docker_containers	Docker container status and port links	✅
04	check_k8s_versions	kubectl/kubeadm/kubelet/containerd/runc/etcd version report	✅
05	check_k8s_services	Status of K8s/container services and recent logs	✅
06	update_k8s_services	K8s stack update with kubeadm	⚠️ No — changes the cluster
07	check_calico	Calico version, optional update	⚠️ Changes only if calico_manifest_url is set
08	check_server_time	Server time/timezone and time-sync service	✅
09	set_server_timezone	Sets the timezone to Europe/Istanbul	⚠️ No — changes a system setting
10	check_system_health	OS/CPU/RAM/disk/process/virtualization report	✅
11	check_monitoring_tools	Installs/checks monitoring tools and produces sample output	⚠️ Installs missing tools
12	get_argocd_password	Reads the ArgoCD admin password	✅
13	check_journal_errors	journalctl kernel + system error/warning logs	✅
14	check_metrics_server	Whether metrics-server is installed/Available	✅
15	get_metrics_server_stats	kubectl top node/pod statistics	✅
16	ensure_metrics_server	Installs if missing, then top statistics	⚠️ Installs if missing
17	check_container_images	Host image inventory (installed/in-use/age)	✅
18	prune_unused_images	Lists unused images / deletes with confirmation	⚠️ Deletes when image_prune_confirm=true
19	check_network_connectivity	Internet access profile via DNS/TCP/HTTP/proxy	✅
20	check_host_ports_firewall	Listening ports, bind type, process + iptables/nft/UFW	✅
21	check_tls_certificates	K8s/PKI + Ingress domain/expiry + TLS secrets	✅
22	check_k8s_warning_events	Kubernetes Warning event summary	✅
23	check_storage_health	Disk/inode + runtime disk + PV/PVC	✅
24	check_node_capacity	Node conditions + capacity/requests/usage	✅
25	check_etcd_controlplane	etcd / control-plane health (k3s+kubeadm)	✅
26	check_cronjobs_jobs	CronJob inventory + Failed Jobs	✅
27	check_cluster_dns	CoreDNS / cluster DNS	✅
28	check_network_policies	NetworkPolicy inventory	✅
29	backup_k8s_etcd	Takes an etcd backup (k3s/kubeadm)	⚠️ No — writes a snapshot to disk and prunes old backups
30	check_large_files	Finds files 1GB+ on the system	✅
31	check_external_endpoints	Tests access to external API/web services	✅
32	verify_etcd_backup	Latest etcd snapshot integrity and optional isolated restore test	⚠️ Restore test is optional
33	check_upgrade_readiness	Pre-upgrade blocker and deprecated API check	✅
34	check_workload_resilience	Probe, resource, replica, PDB, and image resilience checks	✅
35	check_service_endpoints	Service / EndpointSlice ready-backend health	✅
36	check_pod_security_posture	Pod Security Admission and container security posture	✅
37	check_rbac_risks	cluster-admin, wildcard, and privilege-escalation RBAC risks	✅
38	check_control_plane_security	API server, audit, encryption-at-rest, and PKI permissions	✅
39	diagnose_unschedulable_pods	Root-cause analysis for Pending and unschedulable pods	✅
40	check_node_baseline_drift	Node OS/kernel/cgroup/containerd/kubelet drift comparison	✅
41	patch_and_reboot_nodes	Serial drain, package update, reboot, and uncordon	⚠️ Changes with explicit confirmation
42	generate_support_bundle	Redacted Kubernetes/system diagnostic archive	⚠️ Writes an archive on the controller
43	install_kubectl_aliases	kubectl shell alias pack (login shell rc)	⚠️ Writes a dotfile; revert with shell_aliases_state=absent
44	install_helm_aliases	Helm alias pack	⚠️ Writes a dotfile; reversible
45	install_docker_aliases	Docker/Compose alias pack	⚠️ Writes a dotfile; reversible
46	install_git_aliases	Git alias pack	⚠️ Writes a dotfile; reversible
47	install_system_aliases	Shell/system alias pack	⚠️ Writes a dotfile; reversible
48	install_python_aliases	Python/venv alias pack	⚠️ Writes a dotfile; reversible
49	install_virt_aliases	libvirt/virt-manager alias pack	⚠️ Writes a dotfile; reversible
50	install_helper_functions	duh/whoport/bak/extract helpers	⚠️ Writes a dotfile; reversible
51	install_sysupdate_function	Interactive sysupdate shell function	⚠️ Writes a dotfile; reversible
52	run_sysupdate	APT/snap/flatpak maintenance (confirm lock)	⚠️ Changes the host when sysupdate_confirm=true
53	remove_shell_aliases	Lists / deletes all Ansible alias packs	⚠️ Removes all packs when confirmed

Each playbook’s full usage guide (requirements, sample output, notes) is the matching numbered file under docs/.

CI

On every push/PR, GitHub Actions runs yamllint, ansible-lint, example inventory validation, helper script checks, documentation mapping, Kubernetes upgrade policy behavior tests, and --syntax-check for every playbook. CI tool versions are pinned in requirements-ci.txt.

Inventories

• inventories-example/ — Example inventory files kept in the repo (e.g. musteri_a with placeholder host/password values).
• inventories/ — Reserved for real customer/production inventories. The entire directory is gitignored and exists only locally.

Copy inventories-example/musteri_a/hosts.ini as a template and create a new folder under inventories/ for your environment.

In air-gapped environments, replace install-playbook manifest URLs that need an external source with an internal mirror or a file path already copied onto the target host. Required container images must also be available in the environment’s own registry.