jakman85andClaude Opus 4.8
d8101bca38
The k3s nodes authorize ~/.ssh/home_network for the `k3s` user, but ansible.cfg set no private_key_file and there's no ssh_config entry for the SSH-NAT host, so node-config plays (e.g. the rolling k3s config.yaml + Restart handler) failed with Permission denied (publickey). Pin the key so those plays connect without a per-run --private-key. Co-Authored-By: Claude Opus 4.8 <[email protected]>
22 lines
1.0 KiB
INI
22 lines
1.0 KiB
INI
[defaults]
|
|
inventory = inventory/hosts.ini
|
|
roles_path = roles
|
|
host_key_checking = False
|
|
retry_files_enabled = False
|
|
# SSH key the k3s nodes authorize for the `k3s` user (see inventory ansible_user).
|
|
# Set here so node config plays (e.g. the rolling k3s config.yaml + Restart handler) connect
|
|
# without a per-run --private-key. Path is on the operator workstation / dev container ~/.ssh.
|
|
private_key_file = ~/.ssh/home_network
|
|
# ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format.
|
|
stdout_callback = default
|
|
result_format = yaml
|
|
interpreter_python = auto_silent
|
|
# Vault passphrase file — kept OUTSIDE the repo (never committed). Decrypts the vaulted
|
|
# group_vars (e.g. the host become password) so plays run unattended. Create it once:
|
|
# install -m600 /dev/stdin ~/.config/home-k3s/ansible-vault-pass <<<'YOUR_VAULT_PASSPHRASE'
|
|
vault_password_file = ~/.config/home-k3s/ansible-vault-pass
|
|
|
|
[ssh_connection]
|
|
pipelining = True
|
|
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=accept-new
|