Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS + 40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate = Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 01:21:00 -05:00
1 parent 224cd8ac35
commit f2a7e42068
@@ -0,0 +1,11 @@
+---
+# Shared connection + cluster facts for every k3s node.
+
+# cloud-init created this login user (tofu var login_user); it has NOPASSWD sudo.
+ansible_user: k3s
+
+# The kube-apiserver endpoint the whole stack agrees on: the primary node IP.
+# Used for k3s --tls-san / secondary --server AND for Cilium k8sServiceHost so the
+# Ansible bootstrap and the Flux HelmRelease stay in PARITY (docs/02 contract).
+k3s_api_host: "{{ hostvars[groups['k3s_primary'][0]]['ansible_host'] }}"
+k3s_api_port: 6443
@@ -0,0 +1,17 @@
+# Static inventory — ALIGNED with infra/tofu defaults (LOCKED PHASE1-SCOPE IPs).
+# Regenerate from tofu when IPs/names are overridden:
+#   cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
+#
+# k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
+# k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
+
+[k3s_primary]
+k3s-dev-1 ansible_host=10.73.0.11
+
+[k3s_secondary]
+k3s-dev-2 ansible_host=10.73.0.12
+k3s-dev-3 ansible_host=10.73.0.13
+
+[k3s_servers:children]
+k3s_primary
+k3s_secondary