Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/ansible/roles/flux_bootstrap/defaults/main.yml

@@ -0,0 +1,22 @@
+---
+# flux_bootstrap role defaults — the hand-off to the OTHER worker's bootstrap/.
+#
+# THIS ROLE AUTHORS THE CALL, IT DOES NOT OWN bootstrap/. The Security Engineer
+# (T-1.4 SOPS/age) and GitOps Engineer (T-1.4 Flux) author bootstrap/sops/ and
+# bootstrap/flux/. This role INVOKES their entrypoints. The exact script names /
+# args below are ASSUMPTIONS the PM must reconcile with those deliverables — see
+# roles/flux_bootstrap/tasks/main.yml and infra/ansible/README.md "Interface".
+
+flux_bootstrap_kubeconfig: "{{ playbook_dir }}/../.cache/dev.kubeconfig"
+
+# Repo root, relative to playbooks/ (infra/ansible/playbooks -> ../../..).
+flux_bootstrap_repo_root: "{{ playbook_dir }}/../../.."
+
+# Assumed interface of bootstrap/sops (Security Engineer, T-1.4):
+#   installs the age private key as the `sops-age` Secret in flux-system so Flux
+#   can decrypt. Private key stays OUT of git (.gitignore guards age.key/*.key).
+flux_bootstrap_sops_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/sops/install-age-key.sh"
+
+# Assumed interface of bootstrap/flux (GitOps Engineer, T-1.4):
+#   runs `flux bootstrap ... --path=clusters/dev` against this cluster.
+flux_bootstrap_flux_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/flux/bootstrap.sh"

infra/ansible/roles/flux_bootstrap/tasks/main.yml

@@ -0,0 +1,52 @@
+---
+# FINAL play of the bring-up: hand off to Flux + SOPS (Phase 1 T-1.4, docs/02
+# "hands off to Flux"; ADR-0004, ADR-0007). This role does NOT author bootstrap/
+# — it calls the entrypoints the Security + GitOps Engineers author there.
+#
+# Order matters: install the age decryption key FIRST (so Flux can decrypt on its
+# very first reconcile), THEN run `flux bootstrap` at clusters/dev.
+#
+# The two commands are variables (see defaults/main.yml). If the bootstrap workers
+# expose different entrypoints, override flux_bootstrap_sops_cmd / _flux_cmd — the
+# task graph does not change.
+
+- name: Assert the bootstrap/ subtree exists (authored by the other worker)
+  ansible.builtin.stat:
+    path: "{{ flux_bootstrap_repo_root }}/bootstrap"
+  register: bootstrap_dir
+  delegate_to: localhost
+  become: false
+  run_once: true
+  failed_when: not bootstrap_dir.stat.exists
+
+- name: Install the SOPS age key as a cluster Secret (bootstrap/sops)
+  ansible.builtin.command:
+    cmd: "{{ flux_bootstrap_sops_cmd }}"
+  environment:
+    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  changed_when: true
+
+- name: Bootstrap Flux against clusters/dev (bootstrap/flux)
+  ansible.builtin.command:
+    cmd: "{{ flux_bootstrap_flux_cmd }}"
+  environment:
+    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  changed_when: true
+
+- name: Wait for Flux to report the platform Kustomization Ready
+  ansible.builtin.command:
+    cmd: >-
+      kubectl -n flux-system wait kustomization/platform
+      --for=condition=Ready --timeout=600s
+  environment:
+    KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
+  delegate_to: localhost
+  become: false
+  run_once: true
+  changed_when: false