---
# Install the HA k3s control plane (embedded etcd, 3 servers) — ADR-0001.
# Primary founds the cluster (--cluster-init); secondaries join it in a second
# play so the primary's node-token fact is available to them.

- name: k3s primary (cluster-init)
  hosts: k3s_primary
  become: true
  gather_facts: true
  roles:
    - role: k3s_server
      vars:
        k3s_server_mode: primary

# serial: 1 — process one secondary at a time. Matters when a config change (e.g.
# an updated tls-san set) triggers the Restart k3s handler: restarting both
# secondaries at once would drop etcd below quorum. One-at-a-time keeps 2/3 up.
- name: k3s secondaries (join)
  hosts: k3s_secondary
  become: true
  serial: 1
  gather_facts: true
  roles:
    - role: k3s_server
      vars:
        k3s_server_mode: secondary