jakman85andClaude Opus 4.8
f2a7e42068
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
---
|
|
# FINAL play of the bring-up: hand off to Flux + SOPS (Phase 1 T-1.4, docs/02
|
|
# "hands off to Flux"; ADR-0004, ADR-0007). This role does NOT author bootstrap/
|
|
# — it calls the entrypoints the Security + GitOps Engineers author there.
|
|
#
|
|
# Order matters: install the age decryption key FIRST (so Flux can decrypt on its
|
|
# very first reconcile), THEN run `flux bootstrap` at clusters/dev.
|
|
#
|
|
# The two commands are variables (see defaults/main.yml). If the bootstrap workers
|
|
# expose different entrypoints, override flux_bootstrap_sops_cmd / _flux_cmd — the
|
|
# task graph does not change.
|
|
|
|
- name: Assert the bootstrap/ subtree exists (authored by the other worker)
|
|
ansible.builtin.stat:
|
|
path: "{{ flux_bootstrap_repo_root }}/bootstrap"
|
|
register: bootstrap_dir
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
failed_when: not bootstrap_dir.stat.exists
|
|
|
|
- name: Install the SOPS age key as a cluster Secret (bootstrap/sops)
|
|
ansible.builtin.command:
|
|
cmd: "{{ flux_bootstrap_sops_cmd }}"
|
|
environment:
|
|
KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|
|
|
|
- name: Bootstrap Flux against clusters/dev (bootstrap/flux)
|
|
ansible.builtin.command:
|
|
cmd: "{{ flux_bootstrap_flux_cmd }}"
|
|
environment:
|
|
KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: true
|
|
|
|
- name: Wait for Flux to report the platform Kustomization Ready
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
kubectl -n flux-system wait kustomization/platform
|
|
--for=condition=Ready --timeout=600s
|
|
environment:
|
|
KUBECONFIG: "{{ flux_bootstrap_kubeconfig }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: true
|
|
changed_when: false
|