jakman85andClaude Opus 4.8
f2a7e42068
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
29 lines
1.4 KiB
YAML
29 lines
1.4 KiB
YAML
---
|
|
# cilium role defaults (ADR-0002, docs/02 Cilium-ownership contract).
|
|
# This role performs the INITIAL Cilium install; the Flux platform/cilium
|
|
# HelmRelease adopts config afterward. The parity-critical values
|
|
# (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
|
|
|
|
# Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
|
|
cilium_version: "1.16.5"
|
|
cilium_chart_repo_name: "cilium"
|
|
cilium_chart_repo_url: "https://helm.cilium.io/"
|
|
cilium_namespace: "kube-system"
|
|
|
|
# Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
|
|
# Cilium 1.16 targets Gateway API v1.2.x.
|
|
gateway_api_version: "v1.2.1"
|
|
gateway_api_crd_urls:
|
|
- "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
|
|
# TLSRoute (experimental) is required by Cilium's Gateway API support.
|
|
- "https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/{{ gateway_api_version }}/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml"
|
|
|
|
# Local kubeconfig fetched from the primary. *.kubeconfig is gitignored.
|
|
cilium_kubeconfig: "{{ playbook_dir }}/../.cache/dev.kubeconfig"
|
|
cilium_values_path: "{{ playbook_dir }}/../.cache/cilium-values.yaml"
|
|
|
|
# dev: single operator replica to save RAM (PHASE1-SCOPE RAM ceiling). NOT a
|
|
# parity field — Flux may differ here; only kubeProxyReplacement/k8sServiceHost
|
|
# /k8sServicePort must match the HelmRelease.
|
|
cilium_operator_replicas: 1
|