iscsi_portal: 10.0.0.203

iscsi_targets:
  # PROLE-DATA-1
  - iqn: "iqn.2000-01.com.synology:synology.Target-11.292d45194a1"
    chap_user: "prole"
    chap_password: "{{ vault_iscsi_prole_password }}"
    mounts:
      - path: /synology/d001
        fstype: xfs
        opts: "_netdev,noatime"
        src: "UUID=c07dc0f2-cf60-4da5-b68e-ea45e86d473e"

  # PROLE-HOME
  - iqn: "iqn.2000-01.com.synology:synology.Target-17.292d45194a1"
    chap_user: "prole"
    chap_password: "{{ vault_iscsi_prole_password }}"
    mounts:
      - path: /prole/home
        fstype: ext4
        opts: "_netdev,noatime"
        src: "UUID=607718c8-467a-474f-8e36-80ceafe1beb4"

  # PROLE-LOGS
  - iqn: "iqn.2000-01.com.synology:synology.Target-1.292d45194a1"
    chap_user: "prole"
    chap_password: "{{ vault_iscsi_prole_password }}"
    mounts:
      - path: /prole/logs
        fstype: ext4
        opts: "_netdev,noatime"
        src: "UUID=5335affd-b1ab-4134-a1c0-be88ab965309"

iscsi_absent_mounts:
  - /opt/prole/logs/chrisfu
  # Migration cleanup: PROLE-DATA-2/3 are moving off myrddin
  - /prole/d002
  - /prole/d003
  - /synology/d002
  - /synology/d003

# Migration cleanup: ensure myrddin fully logs out of LUNs that are moving to other hosts
iscsi_absent_targets:
  # PROLE-DATA-2
  - "iqn.2000-01.com.synology:synology.Target-12.292d45194a1"
  # PROLE-DATA-3
  - "iqn.2000-01.com.synology:synology.Target-13.292d45194a1"

ad_dc_enabled: true

k3s_enabled: true
k3s_cluster_init: false
k3s_role: server

# K3s state storage (local)
# `/var/lib/rancher` is now backed by a locally attached USB3 SSD on myrddin.
# Shared/iSCSI storage remains reserved for `/prole/*` data paths.
k3s_rancher_mountpoint: /var/lib/rancher
k3s_rancher_storage_class: local_usb3_ssd

# Guardrail: `/var/lib/rancher` must be a dedicated mount (external SSD) and k3s
# must never start if it resolves to the same backing device as `/`.
k3s_rancher_mount_required: true
k3s_rancher_mount_src: "UUID=2e457f8f-fc85-48e7-a7fc-29aad0059268"
k3s_rancher_mount_fstype: ext4
k3s_rancher_mount_opts: "noatime"
k3s_rancher_mount_passno: 2
k3s_token: "{{ vault_k3s_token | default('') }}"   # store this in vault
k3s_datastore_mariadb_host: 10.0.0.6
k3s_datastore_mariadb_port: 3306
k3s_datastore_mariadb_db: k3s
k3s_datastore_mariadb_user: prole_k3s
# Password is the same as the Samba administrator password and must remain in Ansible Vault.
k3s_datastore_mariadb_password: "{{ vault_samba_dns_admin_pass }}"
k3s_datastore_endpoint: "mysql://{{ k3s_datastore_mariadb_user }}:{{ k3s_datastore_mariadb_password | urlencode }}@tcp({{ k3s_datastore_mariadb_host }}:{{ k3s_datastore_mariadb_port }})/{{ k3s_datastore_mariadb_db }}"
k3s_tls_sans:
  - myrddin.prole.org
k3s_service_node_labels:
  - "prole.org/node-role=db"
  - "prole.org/role=control"

# Keep general workloads off the control-plane node; allow only explicitly-tolerating pods.
k3s_node_taints:
  - "node-role.kubernetes.io/control-plane:NoSchedule"

# More forgiving IO/etcd timeouts to reduce error-correction churn on slow storage
k3s_kube_apiserver_args:
  - "request-timeout=60s"
  - "min-request-timeout=60"

k3s_kube_controller_manager_args:
  - "leader-elect-lease-duration=600s"
  - "leader-elect-renew-deadline=420s"
  - "leader-elect-retry-period=60s"
  - "node-monitor-grace-period=10m"
  - "node-startup-grace-period=10m"

k3s_kube_scheduler_args:
  - "leader-elect-lease-duration=600s"
  - "leader-elect-renew-deadline=420s"
  - "leader-elect-retry-period=60s"

k3s_cloud_controller_manager_args:
  - "leader-elect-lease-duration=900s"
  - "leader-elect-renew-deadline=600s"
  - "leader-elect-retry-period=90s"

k3s_kubelet_args:
  - "housekeeping-interval=30s"

k3s_write_kubeconfig_mode: "0640"
k3s_kubeconfig_group: kubeadm
k3s_kubeconfig_users:
  - pi

k3s_required_mounts:
  - /synology/d001