Ansible reads ansible.cfg first to find the inventory and SSH settings. You run ansible-playbook site.yml and the three plays execute in sequence — common finishes on all nodes before master starts, and master finishes before workers join.

• inventory — tells Ansible where to find the list of nodes. Without this, you'd have to pass -i inventory/hosts.ini on every command. Relative to where ansible.cfg lives.
• host_key_checking = False — by default Ansible checks the SSH fingerprint of every host it connects to. Since these are freshly created Vagrant VMs with generated keys, there are no known fingerprints yet — this skips that check so you don't get a prompt or error on first connect.
• remote_user = vagrant — all Vagrant VMs have a default vagrant user with passwordless sudo. This tells Ansible to SSH as that user on every host.
• pipelining = True — instead of uploading a temp script file for every task, Ansible pipes task code directly over SSH. Significantly faster execution, especially for playbooks with many tasks.

Ansible automatically loads any file named all.yml inside group_vars/ and makes every variable available to every play and role. This is the single source of truth for cluster-wide settings — change a version here and it updates everywhere.

The inventory is Ansible's map of the world — it defines every host and how to reach them.

• [master] / [workers] — group names. Plays in site.yml reference these directly: hosts: master runs only on the master group, hosts: workers runs on both workers simultaneously.
• ansible_host — the actual IP Ansible SSH's to. The name on the left (k8s-master) is just a label — without ansible_host, Ansible would try to DNS-resolve "k8s-master", which doesn't exist.
• ansible_ssh_private_key_file — Vagrant auto-generates a unique SSH keypair for each VM and stores it at .vagrant/machines/<name>/virtualbox/private_key. This points Ansible to that key so it can log in without a password.
• [k8s_cluster:children] — creates a parent group containing both master and workers. Used in site.yml Play 1: hosts: k8s_cluster targets all 3 nodes at once.
• [k8s_cluster:vars] — variables applied to every host in the k8s_cluster group. ansible_user = vagrant sets the SSH login user for all nodes in one place.

site.yml is the only file you ever run directly. It defines three plays that execute in strict order — the next play only starts when the previous one succeeds on every targeted host.

• containerd — the container runtime Kubernetes uses instead of Docker. It pulls images, creates containers, and manages their lifecycle.
• SystemdCgroup = true — containerd and kubelet must use the same cgroup driver. The default is cgroupfs but systemd-based systems (like Ubuntu) use systemd. If they disagree, the node crashes at random intervals due to conflicting memory accounting.
• args: creates: — Ansible's idempotency trick for shell tasks. The task is skipped entirely if the specified file already exists. Re-running the playbook won't overwrite a customised config.
• meta: flush_handlers — normally handlers (like "Restart containerd") only run at the very end of a play. flush_handlers forces them to run right now, ensuring containerd is restarted with the new config before the K8s packages are installed.
• dpkg_selections: hold — marks the packages as held so apt upgrade never touches them. A surprise kubeadm upgrade mid-cluster would break the control plane.
• KUBELET_EXTRA_ARGS --node-ip — Vagrant VMs have two NICs: eth0 (NAT, internet) and eth1 (private, cluster). Without this pin, kubelet registers on the NAT interface (10.0.2.15 — same on every VM) and nodes can't find each other. {{ ansible_host }} resolves to the host's IP from the inventory (192.168.56.10/.11/.12).

Handlers are special tasks that only run when notified by another task — and only once, even if notified multiple times. They are Ansible's way of restarting services only when something actually changed.

• When are they triggered? — the "Generate default containerd config" and "Enable SystemdCgroup" tasks both have notify: Restart containerd. If either task makes a change, the handler fires. If neither changed (re-run on already-configured node), the handler is skipped entirely.
• daemon_reload: yes — tells systemd to re-read its unit files before restarting the service. Required if any .service files were changed; harmless if they weren't.

• stat + when: not ... .stat.exists — the idempotency pattern. If /etc/kubernetes/admin.conf already exists, kubeadm init was already run — skip it. Re-running the playbook is safe.
• kubeadm init flags — --pod-network-cidr must match the Calico config; --apiserver-advertise-address binds the API server to the private NIC (not the NAT interface); --node-name must match the VM hostname.
• remote_src: yes — tells the copy module that the source file is already on the remote machine (not on your laptop). Without it, Ansible would look for admin.conf locally and fail.
• become: false on kubectl tasks — the kubeconfig is owned by the vagrant user, so kubectl must run as vagrant, not root. These tasks override the play-level become: true.
• Calico CIDR patch — Calico's default custom-resources.yaml hardcodes 192.168.0.0/16 as the pod CIDR. We patch it to 10.244.0.0/16 to match kubeadm init. If they differ, Calico creates the wrong IP pool and pods get unroutable addresses.
• kubectl wait — blocks until the master reports Ready. Without this gate, workers could try to join before the API server and Calico are fully operational, causing flaky join failures.
• register + set_fact — register captures the command output into a variable. set_fact promotes it to a persistent host fact that survives across plays. Workers read it in the next play via hostvars.

Two tasks. That's all workers need — the heavy lifting was done by the master role.

• stat on kubelet.conf — the idempotency check. This file is only created after a successful kubeadm join. If it exists, the node is already in the cluster — skip the join.
• hostvars['k8s-master']['join_command'] — reads the fact that was set by set_fact in the master role. hostvars is a special Ansible dictionary that holds all facts for all hosts collected during the run. This bridges the data from Play 2 (master) into Play 3 (workers) with no files written to disk.

This is the most important design pattern in the whole playbook. The join command is generated on the master and consumed by two different hosts in a completely different play — with no files written to disk and no manual copy-paste.