# Ansible tasks when provisioning

## 4.3.3.3 Ansible tasks when provisioning

A number of automated tasks are run on your servers when the Ansible Provision action runs. It can be important to understand exactly what Ansible is doing to your servers to help you debug any issues or contribute any improvements to the process.

The Ansible tasks are located in [**infrastructure/server-setup/tasks**](https://github.com/opencrvs/opencrvs-countryconfig/tree/develop/infrastructure/server-setup/tasks)**. Tasks are structured by folders:**

* `all`: tasks are executed on all hosts defined in ansible inventory
* `backups`: tasks to provision backup server
* `k8s`: tasks to configure Kubernetes master and worker nodes

<table data-full-width="true"><thead><tr><th width="182.68359375">Tag</th><th width="259.1953125">Task file</th><th>Purpose</th></tr></thead><tbody><tr><td>checks</td><td>all/checks-system.yml</td><td>Validates that some variables are defined properly in inventory files and Github Secrets</td></tr><tr><td>checks<br>k8s</td><td>all/checks-k8s.yml</td><td>Check Kubernetes installed version with version supported by playbook</td></tr><tr><td>fail2ban</td><td>all/fail2ban.yml</td><td><em>Fail2Ban</em> is an intrusion prevention software framework. Written in the Python programming language, it is designed to prevent brute-force attacks. <em>Fail2Ban</em> scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system firewall</td></tr><tr><td>tools</td><td>all/tools.yml</td><td>Some of our Bash (shell) scripts for deployment, backing up and restoring OpenCRVS for example require some libraries to be installed such as Python <em>pip</em> and <em>jq</em>.</td></tr><tr><td>updates</td><td>all/updates.yml</td><td><p>This task installs and configures the following package with the intention of keeping your current version of Ubuntu automatically up-to-date. We dont guarantee that this works but it should help you. You should always manually check that zero-day security vulnerabilities are applied on Ubuntu. Maintianing your Ubuntu installation is outside the scope of OpenCRVS.</p><pre class="language-yaml"><code class="lang-yaml">unattended-upgrades
</code></pre></td></tr><tr><td>users</td><td>all/users.yml</td><td>This task creates all the user accounts as listed in your inventory files, disables password &#x26; root access, installs and configures SSH key authentication mechanisms with Google Authenticator 2FA.</td></tr><tr><td>backup</td><td>backups/create-backup-server-credentials.yml</td><td>Create backup user and generate ssh keys.</td></tr><tr><td>backup</td><td>backups/setup-email-alert.yml</td><td>Configure email notifications on backup server</td></tr><tr><td>application</td><td>k8s/application.yml</td><td><p>Creates a directory on your server with the right permissions and manages application logs:</p><pre><code>/opt/opencrvs
</code></pre><p>This directory will store all OpenCRVS related application files required for deployment such as the "infrastructure" folder containing docker-compose files for example. The Deploy process copies these files to this location.</p></td></tr><tr><td>k8s</td><td>k8s/backup-secret.yml</td><td>Create secret with backup server credentials (hostname/IP, user, ssh key). Credentials are generated by <code>backups/create-backup-server-credentials.yml</code></td></tr><tr><td>data-partition<br>decrypt-on-boot</td><td>k8s/validate-data-partition.yml</td><td>Encrypted data partition validation to make sure encryption key valid and LUKs header is not demaged.</td></tr><tr><td>data-partition<br>decrypt-on-boot</td><td>k8s/data-partition.yml</td><td><p>Using the DISK_SPACE secret and the ENCRYPTION_KEY secret, a LUKS encrypted directory partition is created to store all OpenCRVS data. The directory is:</p><pre class="language-yaml"><code class="lang-yaml">/data
</code></pre></td></tr><tr><td>decrypt-on-boot</td><td>k8s/decrypt-on-boot.yml</td><td>If your server reboots, the encrypted directory above must be de-crypted and mounted. This file allows you to configure this and the location of the ENCRYPTION_KEY which you could decide to place within a Hardware Security Module for best practice.</td></tr><tr><td>k8s</td><td>k8s/dockerhub-secret.yml</td><td>Create Dockerhub credentials secret inside <code>opencrvs-&#x3C;environment></code> namespace. See <a href="https://github.com/opencrvs/opencrvs-core/issues/10625">#issues/10625</a></td></tr><tr><td>k8s</td><td>k8s/init-master.yml</td><td>Init Kubernetes master node with <code>kubeadm</code>, configure access for provision user, issue join worker node token.</td></tr><tr><td>containerd-setup<br>k8s</td><td>k8s/install-containerd.yml</td><td>Install containerd with dependencies</td></tr><tr><td>k8s</td><td>k8s/install-kubernetes.yml</td><td>Install kubelet, kubeadm, kubectl with dependencies</td></tr><tr><td>k8s</td><td>k8s/install-network-plugin.yml</td><td>Install network plugin on master node</td></tr><tr><td>k8s</td><td>k8s/upgrade-k8s-master.yml</td><td>Upgrade master node on existing Kubernetes cluster</td></tr><tr><td>k8s</td><td>k8s/upgrade-k8s-workers.yml</td><td>Restart kubelet on worker nodes</td></tr><tr><td>k8s<br>join-workers</td><td>k8s/join-workers.yml</td><td>Join worker nodes</td></tr><tr><td>k8s</td><td>k8s/kube-api-add-extra-sans.yml</td><td>Configure SSL certificate for API server to accept connections from multiple network interfaces, including <code>KUBE_API_HOST</code></td></tr><tr><td>k8s</td><td>k8s/label-nodes.yml</td><td>Add labels to kubernetes nodes</td></tr><tr><td>k8s</td><td>k8s/metrics-server.yml</td><td>Install metrics server</td></tr><tr><td>k8s</td><td>k8s/self-hosted-runner.yml</td><td>Install GitHub self-hosted runner</td></tr><tr><td>k8s</td><td>k8s/system-preparation.yml</td><td>Configure kernel settings, disable swap, configure kernel modules for containerd</td></tr><tr><td>k8s<br>users</td><td>k8s/user-kubeconfig.yml</td><td>Create kubernetes users and distribute configuration kube config files across user home directories.</td></tr><tr><td>k8s</td><td>k8s/ufw.yml</td><td>This installs and configures your server firewall using ufw, closing all ports and only opening those required for Docker Swarm and SSH</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.opencrvs.org/v2.0/technical/guides/installation/deploy-set-up-a-server-hosted-environment/provisioning-servers/ansible-tasks-when-provisioning.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.