---
# Install the HA k3s control plane (embedded etcd, 3 servers) — ADR-0001.
# Primary founds the cluster (--cluster-init); secondaries join it in a second
# play so the primary's node-token fact is available to them.
#
# TARGET (R-ENV-02): this is the one playbook that needs TWO patterns, because the
# primary/secondary split is the whole point of the file. Both default to dev:
#   ansible-playbook playbooks/k3s.yml                       # dev, unchanged
#   ansible-playbook playbooks/k3s.yml \
#     -e k3s_primary_hosts=k3s_prod_primary \
#     -e k3s_secondary_hosts=k3s_prod_secondary              # prod
# The role's OWN "who is the primary" lookups (join token delegate_to, tls-san list)
# do NOT use these — they follow the k3s_primary_group / k3s_servers_group group_vars,
# which prod sets once in group_vars/k3s_prod/vars.yml. These two vars only choose which
# hosts the plays RUN on, which Ansible resolves before any group_vars exist.

- name: k3s primary (cluster-init)
  hosts: "{{ k3s_primary_hosts | default('k3s_primary') }}"
  become: true
  gather_facts: true
  roles:
    - role: k3s_server
      vars:
        k3s_server_mode: primary

# serial: 1 — process one secondary at a time. Matters when a config change (e.g.
# an updated tls-san set) triggers the Restart k3s handler: restarting both
# secondaries at once would drop etcd below quorum. One-at-a-time keeps 2/3 up.
- name: k3s secondaries (join)
  hosts: "{{ k3s_secondary_hosts | default('k3s_secondary') }}"
  become: true
  serial: 1
  gather_facts: true
  roles:
    - role: k3s_server
      vars:
        k3s_server_mode: secondary