---
# k3s_server role defaults (ADR-0001).

# Best-effort version pin (kept near the ci/versions kubectl 1.31.x line). Bump
# deliberately — a version change is a code change. Empty string => latest stable.
k3s_version: "v1.31.5+k3s1"

k3s_install_url: "https://get.k3s.io"
k3s_install_script: "/usr/local/bin/k3s-install.sh"

# Components disabled at install so Cilium + Gateway API own networking (ADR-0001/0002).
# flannel + kube-proxy + network-policy are disabled via dedicated flags below;
# traefik + servicelb via --disable.
# local-storage: k3s ships local-path as a DEFAULT StorageClass, which collides with Longhorn's
# default (two default SCs = ambiguous PVC binding). Longhorn (ADR-0003) is the cluster's storage,
# so disable k3s local-path entirely → `longhorn` is the sole default. (Effective on fresh installs;
# the k3s install task is idempotent, so this does not restart an existing cluster — see DECISIONS-LOG.)
k3s_disable: "traefik,servicelb,local-storage"

# Set per-play: 'primary' (runs --cluster-init) or 'secondary' (joins the primary).
k3s_server_mode: "secondary"

# Subject Alternative Names baked into the kube-apiserver serving cert. Must include
# the kube-vip control-plane VIP (kube_vip_address) so TLS via the VIP validates,
# every server's real node IP (so the cert is valid whichever node answers behind
# the VIP), and 127.0.0.1 (local kubeconfig / health probes). k3s regenerates the
# serving cert on restart when this set changes. Deduplicated (the primary IP is
# also k3s_api_host).
k3s_tls_sans: >-
  {{ ([k3s_api_host, kube_vip_address, '127.0.0.1']
      + (groups['k3s_servers'] | map('extract', hostvars, 'k3s_node_ip') | list))
     | unique }}