- Rename host mount namespace from /prole/d00x to /synology/d00x
- Make LUN ownership explicit per host in inventory (myrddin=d001; merlin=d002,d004; pi=d003)
- Add safe migration cleanup for legacy /prole/d00x mounts and stale /etc/fstab entries
- Update k3s/ArgoCD/OpenTofu manifests and PV node affinities to match new mount paths
- Improve iSCSI role check-mode behavior and add quiesce/detach flow in ansible.sh
Update inventory/roles to keep K3s state on local storage and prevent iSCSI from managing /var/lib/rancher.
Also add a single-host k3s install playbook, a systemd override template, and docs describing the installer ↔ Ansible boundary and slow-storage knobs.
Co-authored-by: Junie <junie@jetbrains.com>
- Add diagnostics/reset/retry logic for stuck monitoring Helm installs\n- Add optional cluster-side node/lease deletion during k3s reset via delegated control-plane\n- Bump prole-db image tag/version to 18-123\n- Update monitoring init unit test for reset/diagnostics path
- k3s_sync: choose any server as sync source fallback; refresh kubeconfig and validate nodes\n- fetch_kubeconfig: save to prole-k3s.kubeconfig and etc/secrets/k3s.kubeconfig\n- k3s sync: sync server URL into config.yaml; restore TLS bundle only on servers\n- cert-manager/ACME: wait for CNI/webhook readiness; retry ClusterIssuer/Certificate apply\n- inventory: tune myrddin control-plane timing args; add render test\n- misc: update port mappings and prole-db manifests/version
Co-authored-by: Junie <junie@jetbrains.com>
- Add ssl_hosts group and prole_ssl role to deploy registry cert/key to /etc/ssl/certs/prole
- Configure k8s registry deployment to serve HTTPS using mounted host certs
- Switch k3s/containerd registry mirror config to https:// and prefer HTTPS checks with HTTP fallback
Co-authored-by: Junie <junie@jetbrains.com>
- Added tasks and playbooks for K3s datastore export/import using MariaDB Tools role, with associated tests and defaults.
- Enhanced iSCSI role to support mkfs-once logic and safer re-initialization of block storage.
- Migrated iSCSI-backed Rancher data from retropie to merlin.prole.org.
- Updated k3s roles/playbooks to relax Rancher storage preflight checks, supporting PARTUUID-based mounts.
- Adjusted Samba AD NetBIOS name derivation to use uppercase short hostname by default.
- Incremented prole DB version to 104, updated generated prole.cfg, inventory, and recovery manifest templates.
ArgoCD IO load distribution: Updated k8s/argocd/install.yaml to use hostPath volumes for application-controller (/prole/d001), redis (/prole/d002), and repo-server (/prole/d003). Updated Ansible configure task to create hostPath directories on myrddin.prole.org.
K3s configuration and testing: Added test playbooks for kubeconfig rewriting and argument validation. Updated K3s install, configure, and image import tasks. Configured required mounts and host-specific variables for myrddin.prole.org.
Miscellaneous: Updated conf/prole.cfg with K3S_TOKEN. Bumped prole-db version and updated recovery manifest templates. Minor UI adjustments in cluster screen.
Co-authored-by: Junie <junie@jetbrains.com>
Repairs and improvements:
- iSCSI: Added cleanup tasks to remove stale mounts and fstab entries. Improved robustness of iSCSI target management and added 'iscsi_absent_mounts' support.
- K3s:
- Updated service start logic to accept 'activating' state, preventing premature failure during slow startups.
- Improved service stop logic to safely handle missing or not-found services.
- Ensured 'prole-installer' ServiceAccount and ClusterRoleBinding exist for K8s administration.
- Added leader election and etcd tuning arguments (forgiving leases) to config.yaml.j2.
- Removed deprecated 'prole-port-forwards' systemd service.
- Installer & Scripts:
- Updated legacy_tk.py to support K3s mode, secret resolution for passwords, and better environment management (including ~/.prole/env.sh for service mode).
- Updated init_ansible.sh to support PROLE_VAULT_PASS_FILE and ANSIBLE_VAULT_PASSWORD_FILE.
- Improved directory and kubeconfig path resolution in prole_cfg.sh to support fallback to ~/.prole.
- Enhanced Grafana password resolution in init_monitoring.sh.
- Added automatic application of iSCSI StorageClass and PersistentVolumes in init_openbao.sh.
- General: Switched conf/prole.cfg to k3s deployment mode and updated vault_k3s.yml token.
New Ansible Tasks and Playbooks:
- infrastructure/playbooks/iscsi_cleanup.yml: Automates logout and removal of stale iSCSI node records.
- infrastructure/playbooks/prole_logs_migrate.yml: Orchestrates /prole/logs migration to iSCSI storage.
- infrastructure/playbooks/tmp_bao_dir.yml: Ensures host-level storage directories for OpenBao.
- infrastructure/playbooks/tmp_mount.yml: Utility to verify and enforce host-level mounts.
- infrastructure/playbooks/k3s_sync.yml: Added tasks to start K3s after sync and update local kubeconfig on the controller.
- Added 'Unmount stale iSCSI mounts' and 'Remove stale iSCSI fstab entries' to the iscsi role.
- Added 'Ensure prole-installer service account exists' to the k3s role.
- Moved files from 'prole/' subdirectory to root level or appropriate subdirectories (tests, authority, infrastructure) to flatten the project structure.
- Updated 'install.py' and initialization scripts in 'etc/' to reflect the new directory layout.
- Added 'etc/repair_pipeline.sh' for automated pipeline repairs.
- Updated configuration files including 'conf/prole.cfg' and 'env.sh'.
- Integrated ArgoCD manifests in 'k8s/argocd/'.
- Updated 'prole-app' environment and properties.
- Moved and updated test scripts for better organization and reliability.
- Added 'tests/silent_install_test.sh' for automated installation testing.
- Installer: Updated k3s deployment logic and configuration generation.
- k3s Role: Implemented token drift protection to verify Vault secrets against live node tokens.
- DNS: Enhanced samba_reverse_dns role to support multiple reverse zones.
- Service Init: Updated initialization scripts and status reporting.
- Infrastructure: Added prole management role and k3s diagnostic playbook.
- Configuration: Updated prole.cfg and added vaulted group variables.
- Introduced cgroup kernel parameter management for `k3s_hosts` via Ansible playbook.
- Added Kubernetes PersistentVolumes for iSCSI storage with specific node affinity.
- Defined `prole-iscsi` StorageClass for volume provisioning.
- Added `nodeSelector` for multiple Kubernetes resources to ensure scheduling on `myrddin.prole.org`.
- Modified `storage` requests and set `storageClassName` in `garage-statefulset.yaml`.
- Enhanced `install.py` for dynamic environment configuration and kubeconfig handling.
- Improved cgroup management tasks in Ansible with conflict resolution and parameter updates.
- Simplified vault token update process in playbooks and updated encryption checks.
- Introduced tasks to update the k3s vault token within the `k3s_sync.yml` playbook.
- Includes vault password file handling and vault file encryption/decryption processes.
- Add k3s start/stop Ansible playbooks and roles.
- Implement OpenTofu initialization scripts and k8s manifests.
- Update ncurses installer with OpenTofu support and improved k3s integration.
- Add mode support (--mode) to etc/ initialization scripts.
- Update prole-db with recovery, barman objectstore, and SSH OpenBao support.
- Refine k8s manifests for OpenBao and prole-db.
- Removed the `no_swap` role and replaced it with the new `swap` role for managing swap configurations.
- Updated the K3s role to dynamically detect the first available wired interface IP and validate it.
- Enhanced K3s installation by adding support for disabling SELinux RPM.
- Adjusted inventory and `site.yml` to align with the updated roles.
- Added `.vault_pass` to `.gitignore`.
- Updated Ansible configuration with result format compatibility for different versions.
- Removed the `no_swap` role and replaced it with the new `swap` role for managing swap configurations.
- Updated the K3s role to dynamically detect the first available wired interface IP and validate it.
- Enhanced K3s installation by adding support for disabling SELinux RPM.
- Adjusted inventory and `site.yml` to align with the updated roles.
- Added `.vault_pass` to `.gitignore`.
- Updated Ansible configuration with result format compatibility for different versions.
- Removed the `no_swap` role and replaced it with the new `swap` role for managing swap configurations.
- Updated the K3s role to dynamically detect the first available wired interface IP and validate it.
- Enhanced K3s installation by adding support for disabling SELinux RPM.
- Adjusted inventory and `site.yml` to align with the updated roles.
- Added `.vault_pass` to `.gitignore`.
- Updated Ansible configuration with result format compatibility for different versions.
- Added `k3s_hosts` group to the inventory and associated host entries.
- Updated `site.yml` to include roles for disabling swap and setting up the K3s cluster.
