From 9d6344aac791a7e9510b55fe2352addc39b5ee41 Mon Sep 17 00:00:00 2001
From: David <david.andersson@elastisys.com>
Date: Mon, 25 Nov 2024 17:42:56 +0100
Subject: [PATCH] Add support for ntpsec (#11665)

* Add support for ntpsec

* fixup: set default ntp_driftfile based on ntp_package

* fixup: docs
---
 docs/advanced/ntp.md                                  |  6 ++++++
 roles/kubernetes/preinstall/defaults/main.yml         | 11 ++++++++---
 .../preinstall/tasks/0081-ntp-configurations.yml      |  8 +++++---
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/docs/advanced/ntp.md b/docs/advanced/ntp.md
index a91e09efc..a928d771a 100644
--- a/docs/advanced/ntp.md
+++ b/docs/advanced/ntp.md
@@ -48,3 +48,9 @@ Force sync time immediately by NTP after the ntp installed, which is useful in n
 ```ShellSession
 ntp_force_sync_immediately: true
 ```
+
+When using Ubuntu 24.04 or a distribution that already has `systemd-timesyncd` installed, use the `ntpsec` package.
+
+```ShellSession
+ntp_package: ntpsec
+```
diff --git a/roles/kubernetes/preinstall/defaults/main.yml b/roles/kubernetes/preinstall/defaults/main.yml
index bf537f18d..ec0309d30 100644
--- a/roles/kubernetes/preinstall/defaults/main.yml
+++ b/roles/kubernetes/preinstall/defaults/main.yml
@@ -64,7 +64,7 @@ ping_access_ip: true
 ntp_enabled: false
 # The package to install which provides NTP functionality.
 # The default is ntp for most platforms, or chrony on RHEL/CentOS 7 and later.
-# The ntp_package can be one of ['ntp', 'chrony']
+# The ntp_package can be one of ['ntp', 'ntpsec', 'chrony']
 ntp_package: >-
       {% if ansible_os_family == "RedHat" -%}
       chrony
@@ -95,8 +95,13 @@ ntp_filter_interface: false
 #   - listen xxx
 # The NTP driftfile path
 # Only takes effect when ntp_manage_config is true.
-ntp_driftfile: /var/lib/ntp/ntp.drift
-# Enable tinker panic is useful when running NTP in a VM environment.
+# Default value is `/var/lib/ntp/ntp.drift`, for ntpsec use '/var/lib/ntpsec/ntp.drift'
+ntp_driftfile: >-
+      {% if ntp_package == "ntpsec" -%}
+      /var/lib/ntpsec/ntp.drift
+      {%- else -%}
+      /var/lib/ntp/ntp.drift
+      {%- endif -%}
 # Only takes effect when ntp_manage_config is true.
 ntp_tinker_panic: false
 
diff --git a/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml b/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
index b1e2feead..616ab26bb 100644
--- a/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
+++ b/roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml
@@ -21,6 +21,8 @@
     ntp_config_file: >-
       {% if ntp_package == "ntp" -%}
       /etc/ntp.conf
+      {%- elif ntp_package == "ntpsec" -%}
+      /etc/ntpsec/ntp.conf
       {%- elif ansible_os_family in ['RedHat', 'Suse'] -%}
       /etc/chrony.conf
       {%- else -%}
@@ -56,10 +58,10 @@
   # noqa: jinja[spacing]
   command: >-
       timeout -k 60s 60s
-      {% if ntp_package == "ntp" -%}
-      ntpd -gq
-      {%- else -%}
+      {% if ntp_package == "chrony" -%}
       chronyd -q
+      {%- else -%}
+      ntpd -gq
       {%- endif -%}
   when:
     - ntp_force_sync_immediately