jakman85andClaude Opus 4.8
f2a7e42068
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
23 lines
1.2 KiB
YAML
23 lines
1.2 KiB
YAML
---
|
|
# flux_bootstrap role defaults — the hand-off to the OTHER worker's bootstrap/.
|
|
#
|
|
# THIS ROLE AUTHORS THE CALL, IT DOES NOT OWN bootstrap/. The Security Engineer
|
|
# (T-1.4 SOPS/age) and GitOps Engineer (T-1.4 Flux) author bootstrap/sops/ and
|
|
# bootstrap/flux/. This role INVOKES their entrypoints. The exact script names /
|
|
# args below are ASSUMPTIONS the PM must reconcile with those deliverables — see
|
|
# roles/flux_bootstrap/tasks/main.yml and infra/ansible/README.md "Interface".
|
|
|
|
flux_bootstrap_kubeconfig: "{{ playbook_dir }}/../.cache/dev.kubeconfig"
|
|
|
|
# Repo root, relative to playbooks/ (infra/ansible/playbooks -> ../../..).
|
|
flux_bootstrap_repo_root: "{{ playbook_dir }}/../../.."
|
|
|
|
# Assumed interface of bootstrap/sops (Security Engineer, T-1.4):
|
|
# installs the age private key as the `sops-age` Secret in flux-system so Flux
|
|
# can decrypt. Private key stays OUT of git (.gitignore guards age.key/*.key).
|
|
flux_bootstrap_sops_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/sops/install-age-key.sh"
|
|
|
|
# Assumed interface of bootstrap/flux (GitOps Engineer, T-1.4):
|
|
# runs `flux bootstrap ... --path=clusters/dev` against this cluster.
|
|
flux_bootstrap_flux_cmd: "bash {{ flux_bootstrap_repo_root }}/bootstrap/flux/bootstrap.sh"
|