jakman85andClaude Opus 4.8
f2a7e42068
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
89 lines
2.6 KiB
YAML
89 lines
2.6 KiB
YAML
---
|
|
# Install Cilium as the CNI (ADR-0002). Runs from the controller (dev container,
|
|
# which has kubectl + helm) against a kubeconfig fetched from the primary node.
|
|
# The cluster is NotReady until this completes — expected (PHASE1-SCOPE risks).
|
|
# run_once: this whole role acts on the cluster once, not per host.
|
|
|
|
- name: Fetch the k3s kubeconfig from the primary
|
|
ansible.builtin.slurp:
|
|
src: /etc/rancher/k3s/k3s.yaml
|
|
register: k3s_kubeconfig_raw
|
|
delegate_to: "{{ groups['k3s_primary'][0] }}"
|
|
run_once: true
|
|
|
|
- name: Ensure the local cache dir exists
|
|
ansible.builtin.file:
|
|
path: "{{ cilium_kubeconfig | dirname }}"
|
|
state: directory
|
|
mode: "0700"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Write kubeconfig locally (server rewritten to the primary IP)
|
|
ansible.builtin.copy:
|
|
content: >-
|
|
{{ k3s_kubeconfig_raw.content | b64decode
|
|
| regex_replace('https://127.0.0.1:6443',
|
|
'https://' ~ k3s_api_host ~ ':' ~ k3s_api_port) }}
|
|
dest: "{{ cilium_kubeconfig }}"
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Install Gateway API CRDs (must precede Cilium gatewayAPI.enabled)
|
|
ansible.builtin.command:
|
|
cmd: "kubectl apply -f {{ item }}"
|
|
environment:
|
|
KUBECONFIG: "{{ cilium_kubeconfig }}"
|
|
loop: "{{ gateway_api_crd_urls }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|
|
|
|
- name: Add the Cilium Helm repo
|
|
ansible.builtin.command:
|
|
cmd: "helm repo add {{ cilium_chart_repo_name }} {{ cilium_chart_repo_url }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
register: cilium_repo_add
|
|
changed_when: "'has been added' in cilium_repo_add.stdout"
|
|
failed_when:
|
|
- cilium_repo_add.rc != 0
|
|
- "'already exists' not in cilium_repo_add.stderr"
|
|
|
|
- name: Update Helm repos
|
|
ansible.builtin.command:
|
|
cmd: "helm repo update {{ cilium_chart_repo_name }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: false
|
|
|
|
- name: Render the Cilium values file (parity-critical settings from k3s_api_host)
|
|
ansible.builtin.template:
|
|
src: cilium-values.yaml.j2
|
|
dest: "{{ cilium_values_path }}"
|
|
mode: "0644"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Install/upgrade Cilium via Helm
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
helm upgrade --install cilium {{ cilium_chart_repo_name }}/cilium
|
|
--version {{ cilium_version }}
|
|
--namespace {{ cilium_namespace }}
|
|
--values {{ cilium_values_path }}
|
|
--wait --timeout 10m
|
|
environment:
|
|
KUBECONFIG: "{{ cilium_kubeconfig }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|