Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity
346 Commits 138 Branches 0 Tags
df947b33d00707e894e896f7d6580a3661473607
Commit Graph
4 Commits
Author SHA1 Message Date
jakman85andClaude Opus 4.8 d8101bca38 chore(ansible): set private_key_file for k3s node connectivity 
The k3s nodes authorize ~/.ssh/home_network for the `k3s` user, but ansible.cfg
set no private_key_file and there's no ssh_config entry for the SSH-NAT host, so
node-config plays (e.g. the rolling k3s config.yaml + Restart handler) failed
with Permission denied (publickey). Pin the key so those plays connect without a
per-run --private-key.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
 2026-08-26 15:27:29 -05:00
jakman85andClaude Opus 4.8 4e2ca88bd4 Wire ansible-vault for host become password (unattended host-prereqs) 
Where the sudo password goes, codified:
- inventory: new [hypervisor] group (localhost, connection=local).
- host-prereqs.yml targets 'hypervisor'; become password from vaulted
  group_vars/hypervisor/vault.yml (ansible_become_password) — user creates it
  encrypted (safe to commit); README documents the exact commands.
- ansible.cfg vault_password_file = ~/.config/home-k3s/ansible-vault-pass
  (passphrase kept OUTSIDE the repo, never committed).
- ci/yamllint.yaml ignores **/vault.yml (vault blob isn't parseable YAML).
Nodes keep NOPASSWD sudo (group_vars/all) — vault scoped to the host only.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
 2026-08-16 15:04:44 -05:00
jakman85andClaude Opus 4.8 125ca428bc fix(phase1): two execution-surfaced bugs bringing up k3s+Cilium 
- ansible.cfg: stdout_callback 'yaml' (community.general.yaml) was REMOVED in
  ansible-core 2.20 -> use builtin default + result_format=yaml.
- cilium-values: egressGateway.enabled requires ipv4+eBPF masquerade or the
  agent fatals at startup ('egress gateway requires --enable-ipv4-masquerade
  and --enable-bpf-masquerade'). Add enableIPv4Masquerade + bpf.masquerade=true
  (also the correct pairing with kubeProxyReplacement; [parity] w/ platform/cilium).

Verified live: 3/3 nodes Ready, embedded-etcd HA, Cilium status OK, CoreDNS up.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
 2026-08-16 02:04:50 -05:00
jakman85andClaude Opus 4.8 f2a7e42068 Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3) 
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
 2026-08-16 01:21:00 -05:00