chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 12:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2e517686a8
prole/docs/ansible-installer-boundary.md
chrisfu 5dcd3b9581 ansible: treat /var/lib/rancher as local K3s state 
Update inventory/roles to keep K3s state on local storage and prevent iSCSI from managing /var/lib/rancher.

Also add a single-host k3s install playbook, a systemd override template, and docs describing the installer ↔ Ansible boundary and slow-storage knobs.

Co-authored-by: Junie <junie@jetbrains.com>
2026-03-15 23:20:55 -07:00

2.5 KiB
Raw Blame History

Installer ↔ Ansible boundary

install.py (and the installer/ package) and Ansible are treated as independent tools.

  • The installer may invoke ansible / ansible-playbook as an external subprocess.
  • The installer must not assume:
    • Ansible vault access
    • inventory parsing as a required part of the workflow
    • any specific private repo checkout layout (e.g. a sibling prole/infrastructure)
  • Ansible playbooks/roles must not assume install.py is discovering secrets or passing hidden, repo-local state.

This is designed so private inventory/secret material can live entirely in prole/infrastructure (or elsewhere) without this repo requiring it.

Explicit inputs (recommended)

When the installer needs to call ansible-playbook (for example to fetch a kubeconfig), provide paths explicitly via environment variables:

  • PROLE_ANSIBLE_K3S_FETCH_KUBECONFIG_PLAYBOOK
    • Full path to k3s_fetch_kubeconfig.yml.
  • PROLE_ANSIBLE_PLAYBOOKS_DIR (or PROLE_ANSIBLE_PLAYBOOK_DIR)
    • Directory that contains k3s_fetch_kubeconfig.yml.
  • PROLE_ANSIBLE_INVENTORY (or ANSIBLE_INVENTORY)
    • Inventory path passed as ansible-playbook -i ....
  • PROLE_ANSIBLE_VAULT_PASSWORD_FILE (or ANSIBLE_VAULT_PASSWORD_FILE)
    • Vault password file path passed as ansible-playbook --vault-password-file ....
  • PROLE_ANSIBLE_CONFIG (or ANSIBLE_CONFIG)
    • Path to an Ansible config file to use for the subprocess.

Separately, when the deployment workflow needs k3s connection info, provide it explicitly:

  • PROLE_K3S_SERVER
  • PROLE_K3S_TOKEN (or K3S_TOKEN)

Optional legacy auto-detection (opt-in)

For local developer convenience only, repo-relative discovery can be enabled explicitly:

  • PROLE_ANSIBLE_AUTO_DETECT=true

When enabled, some flows may look for legacy repo-relative playbooks (under infrastructure/playbooks/). This is not required for normal operation and should not be relied on for private infrastructure.

K3s slow-storage tolerance knobs (Ansible)

The infrastructure/roles/k3s role exposes configurable defaults intended for slow storage (Pi / USB) rollouts:

  • k3s_kubelet_args (default includes runtime-request-timeout=15m, image-pull-progress-deadline=15m, node-status-update-frequency=20s)
  • k3s_systemd_override_enabled (default true)
  • k3s_systemd_timeout_start_sec (default 15min)
  • k3s_systemd_timeout_stop_sec (default 10min)
  • k3s_systemd_restart (default always)
  • k3s_systemd_restart_sec (default 15s)