---
# Restart k3s so a changed config.yaml (e.g. an updated tls-san set) takes effect
# and the serving cert is regenerated. RUN THIS ROLLING (serial: 1) — restarting
# more than one server at once would break etcd quorum. The wait below gates the
# next node until this one's API is serving again.
- name: Restart k3s
  ansible.builtin.systemd_service:
    name: k3s
    state: restarted
  listen: Restart k3s

- name: Wait for the k3s API to be serving locally after restart
  ansible.builtin.wait_for:
    host: "127.0.0.1"
    port: "{{ k3s_api_port }}"
    timeout: 180
  listen: Restart k3s