The k3s nodes authorize ~/.ssh/home_network for the `k3s` user, but ansible.cfg set no private_key_file and there's no ssh_config entry for the SSH-NAT host, so node-config plays (e.g. the rolling k3s config.yaml + Restart handler) failed with Permission denied (publickey). Pin the key so those plays connect without a per-run --private-key. Co-Authored-By: Claude Opus 4.8 <[email protected]>
infra/ — Phase 1 node provisioning (local KVM)
OpenTofu (libvirt) + cloud-init + Ansible bring up the 3-node k3s/Cilium cluster. See PHASE1-SCOPE.md. Spec: ../home-network-k3s/docs/02-environments-and-provisioning.md.