---
# Restart k3s so a changed config.yaml (e.g. an updated tls-san set) takes effect
# and the serving cert is regenerated. RUN THIS ROLLING (serial: 1) — restarting
# more than one server at once would break etcd quorum. The wait below gates the
# next node until this one's API is serving again.
- name: Restart k3s
  ansible.builtin.systemd_service:
    name: k3s
    state: restarted
  listen: Restart k3s

- name: Wait for the k3s API to be serving locally after restart
  ansible.builtin.wait_for:
    host: "127.0.0.1"
    port: "{{ k3s_api_port }}"
    timeout: 180
  listen: Restart k3s

# logind re-reads InhibitDelayMaxSec only on restart. Restarting logind does NOT log users out or
# disturb k3s -- it manages login sessions and inhibitor locks, not workloads. The kubelet picks up
# the new cap when it next takes its lock, so no k3s restart is needed for THIS half.
- name: Restart logind
  ansible.builtin.systemd_service:
    name: systemd-logind
    state: restarted
  listen: Restart logind