tofu(proxmox): API-only native cloud-init; move node baseline to Ansible node_baseline role

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/collections/requirements.yml

@@ -0,0 +1,8 @@
+---
+# Ansible Galaxy collections required by infra/ansible. Install with:
+#   ansible-galaxy collection install -r collections/requirements.yml
+collections:
+  # node_baseline role: community.general.modprobe, community.general.filesystem
+  - name: community.general
+  # node_baseline role: ansible.posix.mount
+  - name: ansible.posix

infra/ansible/playbooks/node-baseline.yml

@@ -0,0 +1,10 @@
+---
+# Node baseline — first-boot floor for k3s/Cilium/Longhorn, moved from cloud-init into
+# Ansible so Proxmox provisioning stays API-only (no SSH/SFTP to the hypervisor). Runs
+# FIRST in site.yml, before k3s. Idempotent; safe to re-run.
+- name: Baseline the k3s nodes (packages, kernel modules, Longhorn disk, swap-off)
+  hosts: k3s_servers
+  become: true
+  gather_facts: true
+  roles:
+    - node_baseline

infra/ansible/playbooks/site.yml

@@ -2,6 +2,9 @@
 # Full dev/test cluster bring-up, in order (docs/02 sequencing; run AFTER
 # `tofu apply` has created and cloud-init has baselined the VMs):
 #   k3s HA install -> Cilium CNI -> verify readiness -> Flux + SOPS hand-off.
+- name: Import - node baseline (packages, kernel modules, Longhorn disk, swap-off)
+  ansible.builtin.import_playbook: node-baseline.yml
+
 - name: Import - install k3s HA control plane
   ansible.builtin.import_playbook: k3s.yml
 

infra/ansible/roles/node_baseline/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+# node_baseline — first-boot floor for k3s/Cilium/Longhorn, moved out of cloud-init
+# (Proxmox provisioning is API-only). Runs before k3s (site.yml). Idempotent.
+node_baseline_packages:
+  - qemu-guest-agent
+  - open-iscsi
+  - nfs-common
+  - curl
+node_baseline_kernel_modules:
+  - overlay
+  - br_netfilter
+  - iscsi_tcp
+  - dm_crypt
+  - nfs
+node_baseline_longhorn_device: /dev/vdb
+node_baseline_longhorn_mount: /var/lib/longhorn
+node_baseline_longhorn_fs_label: longhorn

infra/ansible/roles/node_baseline/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: Reload sysctl
+  ansible.builtin.command: sysctl --system
+  changed_when: true

infra/ansible/roles/node_baseline/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+- name: Install baseline packages (guest agent, Longhorn/iscsi/nfs prereqs)
+  ansible.builtin.apt:
+    name: "{{ node_baseline_packages }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Persist kernel modules for k3s/Cilium/Longhorn
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k3s-cilium-longhorn.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: "{{ node_baseline_kernel_modules | join('\n') }}\n"
+
+- name: Load kernel modules now
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ node_baseline_kernel_modules }}"
+
+- name: Install sysctl tuning for k3s/Cilium
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/99-k3s-cilium.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+      net.ipv6.conf.all.forwarding        = 1
+      fs.inotify.max_user_instances       = 8192
+      fs.inotify.max_user_watches         = 524288
+  notify: Reload sysctl
+
+- name: Enable and start iscsid (Longhorn) and qemu-guest-agent
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - iscsid
+    - qemu-guest-agent
+
+- name: Create ext4 filesystem on the Longhorn data disk (data-safe; skips if present)
+  community.general.filesystem:
+    fstype: ext4
+    dev: "{{ node_baseline_longhorn_device }}"
+    opts: "-L {{ node_baseline_longhorn_fs_label }}"
+
+- name: Mount the Longhorn data disk
+  ansible.posix.mount:
+    path: "{{ node_baseline_longhorn_mount }}"
+    src: "LABEL={{ node_baseline_longhorn_fs_label }}"
+    fstype: ext4
+    opts: "defaults,nofail,x-systemd.device-timeout=5s"
+    state: mounted
+
+- name: Disable swap now
+  ansible.builtin.command: swapoff -a
+  changed_when: false
+
+- name: Neutralize swap entries in fstab (kubelet requires swap off)
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^([^#].*\sswap\s.*)$'
+    replace: '# \1  # disabled for k3s/kubelet'