---
# Node hardware health — READ-ONLY inspection of a node's disks, memory, CPU, thermals,
# network and pressure-stall state. Installs nothing, changes nothing, safe to run at any
# time against dev or prod (see roles/node_health for the full contract).
#
#   ./dev.sh run bash -c 'cd /work/infra/ansible && \
#       ansible-playbook playbooks/node-health.yml -e node_health_hosts=k3s_prod'
#
# TARGET GROUP IS A VARIABLE. This play established that pattern; the rest of the node
# playbooks (node-baseline.yml, k3s.yml, cilium.yml, kube-vip.yml, verify.yml,
# flux-bootstrap.yml) now follow it and take `k3s_hosts` / `k3s_primary_hosts` /
# `k3s_secondary_hosts` instead of the literal dev groups they used to hardcode — see
# infra/ansible/README.md "Targeting prod". This one keeps its OWN var name because it is
# a standalone diagnostic you point anywhere, not a step in the bring-up chain: it must
# stay independently targetable (`-e node_health_hosts=<group>`) even while a bring-up run
# is scoped elsewhere. Run it against prod with `-e node_health_hosts=k3s_prod`, or a
# single box with `--limit`.
#
# BECOME: left at the play level exactly as the inventory sets it. The role itself pins
# `ansible_become: false` on every unprivileged task and probes escalation once before
# attempting the only root-only check (SMART), so this play behaves correctly on dev
# (NOPASSWD sudo) and on prod (vaulted become password, or none at all) without any
# per-environment flags. See roles/node_health/tasks/main.yml for why that has to be a
# variable override rather than `become: false`.
- name: Inspect node hardware health (read-only)
  hosts: "{{ node_health_hosts | default('k3s_servers') }}"
  # The role's own collector supersedes ansible.builtin.setup for this purpose (setup
  # exposes no thermal zones, no EDAC, no PSI, no per-disk error counters), so skip the
  # fact gathering round trip entirely.
  gather_facts: false
  roles:
    - node_health