Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS + 40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate = Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 01:21:00 -05:00
1 parent 224cd8ac35
commit f2a7e42068
@@ -0,0 +1,65 @@
+---
+# Verify the cluster reached the Phase-1 exit gate #1: 3 nodes Ready, Cilium
+# healthy (Hubble up), no flannel/kube-proxy. Runs from the controller once.
+
+- name: Wait for all nodes to be Ready (Cilium must be up first)
+  ansible.builtin.command:
+    cmd: >-
+      kubectl wait --for=condition=Ready nodes --all
+      --timeout={{ cluster_verify_node_ready_timeout }}
+  environment:
+    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  changed_when: false
+
+- name: Wait for the Cilium DaemonSet to roll out
+  ansible.builtin.command:
+    cmd: >-
+      kubectl -n kube-system rollout status ds/cilium --timeout=300s
+  environment:
+    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  changed_when: false
+
+- name: Wait for hubble-relay to be available
+  ansible.builtin.command:
+    cmd: >-
+      kubectl -n kube-system rollout status deploy/hubble-relay --timeout=300s
+  environment:
+    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  changed_when: false
+
+- name: Confirm kube-proxy is absent (Cilium replaces it)
+  ansible.builtin.command:
+    cmd: "kubectl -n kube-system get ds kube-proxy"
+  environment:
+    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: kube_proxy_check
+  changed_when: false
+  failed_when: kube_proxy_check.rc == 0
+
+- name: Summarise cluster state
+  ansible.builtin.command:
+    cmd: "kubectl get nodes -o wide"
+  environment:
+    KUBECONFIG: "{{ cluster_verify_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: cluster_nodes
+  changed_when: false
+
+- name: Show nodes
+  ansible.builtin.debug:
+    var: cluster_nodes.stdout_lines
+  run_once: true