Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/ansible/playbooks/cilium.yml

@@ -0,0 +1,9 @@
+---
+# Install Cilium as the CNI (ADR-0002). The cluster is NotReady until this runs.
+# Executed from the controller against a fetched kubeconfig (role handles delegation).
+- name: Install Cilium CNI
+  hosts: k3s_servers
+  become: true
+  gather_facts: false
+  roles:
+    - role: cilium

infra/ansible/playbooks/flux-bootstrap.yml

@@ -0,0 +1,9 @@
+---
+# FINAL step: hand off to Flux + SOPS (T-1.4). Calls into bootstrap/ (authored by
+# the Security + GitOps Engineers) — this play does not author that subtree.
+- name: Flux + SOPS bootstrap hand-off
+  hosts: k3s_servers
+  become: false
+  gather_facts: false
+  roles:
+    - role: flux_bootstrap

infra/ansible/playbooks/k3s.yml

@@ -0,0 +1,22 @@
+---
+# Install the HA k3s control plane (embedded etcd, 3 servers) — ADR-0001.
+# Primary founds the cluster (--cluster-init); secondaries join it in a second
+# play so the primary's node-token fact is available to them.
+
+- name: k3s primary (cluster-init)
+  hosts: k3s_primary
+  become: true
+  gather_facts: true
+  roles:
+    - role: k3s_server
+      vars:
+        k3s_server_mode: primary
+
+- name: k3s secondaries (join)
+  hosts: k3s_secondary
+  become: true
+  gather_facts: true
+  roles:
+    - role: k3s_server
+      vars:
+        k3s_server_mode: secondary

infra/ansible/playbooks/site.yml

@@ -0,0 +1,15 @@
+---
+# Full dev/test cluster bring-up, in order (docs/02 sequencing; run AFTER
+# `tofu apply` has created and cloud-init has baselined the VMs):
+#   k3s HA install -> Cilium CNI -> verify readiness -> Flux + SOPS hand-off.
+- name: Import - install k3s HA control plane
+  ansible.builtin.import_playbook: k3s.yml
+
+- name: Import - install Cilium CNI
+  ansible.builtin.import_playbook: cilium.yml
+
+- name: Import - verify cluster readiness
+  ansible.builtin.import_playbook: verify.yml
+
+- name: Import - Flux + SOPS bootstrap hand-off
+  ansible.builtin.import_playbook: flux-bootstrap.yml

infra/ansible/playbooks/verify.yml

@@ -0,0 +1,8 @@
+---
+# Verify Phase-1 exit gate #1: 3 nodes Ready, Cilium/Hubble healthy, no kube-proxy.
+- name: Verify cluster readiness
+  hosts: k3s_servers
+  become: false
+  gather_facts: false
+  roles:
+    - role: cluster_verify