OpenSec Atlas

kubeadm-playbook: An Open Source Script for Cloud Security | OpenSec Atlas

Cloud Security

Script

kubeadm-playbook

An Ansible-based playbook that automates the deployment of highly available Kubernetes clusters using kubeadm and official Helm charts with best practices for on-prem environments.

Visit Website View on GitHub

About This Tool

Fully fledged (HA) Kubernetes Cluster using official kubeadm, ansible and helm. Tested on RHEL/CentOS/Ubuntu with support of http_proxy, dashboard installed, ingress controller, heapster - using official helm charts

Primary Use Case

This tool is designed for system administrators and DevOps engineers who want to deploy and manage production-grade Kubernetes clusters on-premises or in private environments using kubeadm. It simplifies cluster setup, addon installation, and scaling while ensuring enterprise readiness with support for proxies, private registries, and HA configurations.

Key Features

Fully kubeadm-based Kubernetes cluster installation with HA support
Automated deployment of official Helm chart addons like ingress controller, dashboard, and heapster
Supports node segregation into master, infra, and compute roles for better cluster organization
Enterprise-friendly with http_proxy and private Docker registry support
Scale up or down clusters post-deployment without downtime
Supports VIPs via keepalived or hardware load balancers for HA ingress and master nodes
Compatible with RHEL/CentOS and Ubuntu distributions
Configurable addons via addons.yml for flexibility

Insights & Recommendations

This project is best suited for on-premises Kubernetes deployments and requires familiarity with Ansible, kubeadm, and Helm. It emphasizes simplicity by relying solely on kubeadm and official Helm charts, avoiding custom addons. Users should prepare their environment with proper networking, proxy, and private registry configurations if applicable. The tool supports scaling and HA setups without downtime, making it suitable for production use. LDAP authentication and logging stack integration are planned for future releases.

Installation

Clone the repository from https://github.com/ReSearchITEng/kubeadm-playbook
Prepare your inventory file to define cluster nodes and roles
Configure optional settings such as docker_setup, private registries, and proxy if needed
Run the Ansible playbook to deploy the Kubernetes cluster and addons
Use Helm to manage additional addons as defined in addons.yml

Usage

ansible-playbook -i inventory.ini site.yml

Runs the main Ansible playbook to deploy the Kubernetes cluster and configured addons

helm install <addon> <official-helm-chart>

Installs or manages Kubernetes addons using official Helm charts as configured by the playbook

Smart Usage Notes

Integrate this playbook with CI/CD pipelines to automate secure Kubernetes cluster deployments with consistent security configurations.
Leverage node segregation (master, infra, compute) to enforce role-based access controls and limit lateral movement in case of compromise.
Combine with runtime security tools (e.g., Falco, Aqua Security) for enhanced detection of anomalous container or cluster behavior.
Use the playbook's support for private registries and proxies to enforce supply chain security and reduce exposure to malicious images.
Extend the playbook with automated compliance checks against Kubernetes CIS Benchmarks to maintain continuous configuration compliance.