jakman85andClaude Opus 4.8
d57c9cbf12
- ansible hosts.ini: node ansible_host -> 192.168.1.50/.51/.52, with a clear note that the PM may need to swap these for the pfSense NAT-forwarded address:port once that NAT rule exists (not guessed here). k3s_api_host derives from the inventory, so it follows automatically. - Cilium CiliumLoadBalancerIPPool -> 192.168.1.53-.60 (matches the tofu cilium_l2_vip reservation on the new LAN). - CiliumL2AnnouncementPolicy: broaden interface selector to ^e(n|th) so the Proxmox NIC name (ens18/eth0) need not be pinned; flagged verify-at-bringup. Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
1.6 KiB
INI
37 lines
1.6 KiB
INI
# Static inventory — ALIGNED with infra/tofu defaults (Proxmox migration IPs).
|
|
# Regenerate from tofu when IPs/names are overridden:
|
|
# cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
|
|
#
|
|
# k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
|
|
# k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
|
|
#
|
|
# NAT HAND-OFF (PM to finalize): the nodes now live on the Proxmox LAN at
|
|
# 192.168.1.50/.51/.52. The PM reaches them over a pfSense NAT that is NOT yet created.
|
|
# Once the NAT/port-forward rule exists, the `ansible_host` (and possibly
|
|
# `ansible_port`) below may need to be the NAT-forwarded address:port instead of the
|
|
# raw node IP — do NOT guess it here. If the control node has direct LAN reachability
|
|
# to 192.168.1.0/24, the raw IPs below are correct as-is.
|
|
|
|
[k3s_primary]
|
|
k3s-dev-1 ansible_host=192.168.1.50
|
|
|
|
[k3s_secondary]
|
|
k3s-dev-2 ansible_host=192.168.1.51
|
|
k3s-dev-3 ansible_host=192.168.1.52
|
|
|
|
[k3s_servers:children]
|
|
k3s_primary
|
|
k3s_secondary
|
|
|
|
# The hypervisor/workstation host itself (target of host-prereqs.yml). Its become
|
|
# (sudo) password comes from the vaulted group_vars/hypervisor/vault.yml.
|
|
[hypervisor]
|
|
localhost ansible_connection=local
|
|
|
|
# VPN egress-gateway node(s) — run the node-level split-tunnel OpenVPN + kill-switch
|
|
# (ADR-0015, playbooks/vpn.egress.gateway.yml). Initially just k3s-dev-3 (single gateway;
|
|
# add a second host here for Cilium Egress Gateway HA). Members are already defined above
|
|
# with their ansible_host under k3s_secondary; this group only tags the egress role target.
|
|
[vpn_egress_gateway]
|
|
k3s-dev-3
|