---
- name: Ensure k3s rancher mount guardrail is opt-in and implemented via systemd drop-in
  hosts: localhost
  connection: local
  gather_facts: false
  become: false

  tasks:
    - name: Read k3s install tasks
      ansible.builtin.set_fact:
        _k3s_install_tasks: "{{ lookup('ansible.builtin.file', playbook_dir ~ '/../tasks/install.yml') }}"

    - name: Assert rancher mount guardrail exists and is opt-in
      ansible.builtin.assert:
        that:
          - (_k3s_install_tasks is search('Guardrail - enforce dedicated rancher mount')) == true
          - (_k3s_install_tasks is search('RequiresMountsFor=')) == true
          - (_k3s_install_tasks is search('k3s_rancher_mountpoint')) == true
          - (_k3s_install_tasks is search('findmnt -n -o SOURCE -T')) == true
          - (_k3s_install_tasks is search('findmnt -n -o SOURCE -T /')) == true
        fail_msg: >-
          k3s role should implement an opt-in guardrail that forces k3s to require
          a dedicated `/var/lib/rancher` mount (via systemd drop-in + preflight),
          without impacting nodes that intentionally keep rancher storage on `/`.

# end