home-network-k3s-impl/infra/ansible/roles/cilium/tasks/main.yml

---
# Install Cilium as the CNI (ADR-0002). Runs from the controller (dev container,
# which has kubectl + helm) against a kubeconfig fetched from the primary node.
# The cluster is NotReady until this completes — expected (PHASE1-SCOPE risks).
# run_once: this whole role acts on the cluster once, not per host.

# k3s_primary_group (group_vars) names THIS environment's primary group — `k3s_primary`
# on dev, `k3s_prod_primary` on prod — so the role fetches the right cluster's kubeconfig
# without being forked per environment (R-ENV-02).
- name: Fetch the k3s kubeconfig from the primary
  ansible.builtin.slurp:
    src: /etc/rancher/k3s/k3s.yaml
  register: k3s_kubeconfig_raw
  delegate_to: "{{ groups[k3s_primary_group][0] }}"
  run_once: true

- name: Ensure the local cache dir exists
  ansible.builtin.file:
    path: "{{ cilium_kubeconfig | dirname }}"
    state: directory
    mode: "0700"
  delegate_to: localhost
  become: false
  run_once: true

- name: Write kubeconfig locally (server rewritten to the direct NAT endpoint)
  ansible.builtin.copy:
    content: >-
      {{ k3s_kubeconfig_raw.content | b64decode
         | regex_replace('https://127.0.0.1:6443', cluster_controller_api_server) }}
    dest: "{{ cilium_kubeconfig }}"
    mode: "0600"
  delegate_to: localhost
  become: false
  run_once: true

- name: Read the cluster name from the written kubeconfig
  ansible.builtin.command:
    cmd: "kubectl config view -o jsonpath={.clusters[0].name}"
  environment:
    KUBECONFIG: "{{ cilium_kubeconfig }}"
  register: cilium_kubeconfig_cluster
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false

- name: Pin tls-server-name to the kube-vip VIP so TLS validates through the NAT
  ansible.builtin.command:
    cmd: >-
      kubectl config set
      clusters.{{ cilium_kubeconfig_cluster.stdout }}.tls-server-name
      {{ cluster_controller_tls_server_name }}
  environment:
    KUBECONFIG: "{{ cilium_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Install Gateway API CRDs (must precede Cilium gatewayAPI.enabled)
  ansible.builtin.command:
    cmd: "kubectl apply -f {{ item }}"
  environment:
    KUBECONFIG: "{{ cilium_kubeconfig }}"
  loop: "{{ gateway_api_crd_urls }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true

- name: Add the Cilium Helm repo
  ansible.builtin.command:
    cmd: "helm repo add {{ cilium_chart_repo_name }} {{ cilium_chart_repo_url }}"
  delegate_to: localhost
  become: false
  run_once: true
  register: cilium_repo_add
  changed_when: "'has been added' in cilium_repo_add.stdout"
  failed_when:
    - cilium_repo_add.rc != 0
    - "'already exists' not in cilium_repo_add.stderr"

- name: Update Helm repos
  ansible.builtin.command:
    cmd: "helm repo update {{ cilium_chart_repo_name }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: false

- name: Render the Cilium values file (parity-critical settings from k3s_api_host)
  ansible.builtin.template:
    src: cilium-values.yaml.j2
    dest: "{{ cilium_values_path }}"
    mode: "0644"
  delegate_to: localhost
  become: false
  run_once: true

- name: Install/upgrade Cilium via Helm
  ansible.builtin.command:
    cmd: >-
      helm upgrade --install cilium {{ cilium_chart_repo_name }}/cilium
      --version {{ cilium_version }}
      --namespace {{ cilium_namespace }}
      --values {{ cilium_values_path }}
      --wait --timeout 10m
  environment:
    KUBECONFIG: "{{ cilium_kubeconfig }}"
  delegate_to: localhost
  become: false
  run_once: true
  changed_when: true