mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
114 lines
4.2 KiB
YAML
114 lines
4.2 KiB
YAML
---
|
|
k3s_enabled: true
|
|
k3s_state: present
|
|
k3s_version: ""
|
|
k3s_guard_token_drift: true
|
|
|
|
# k3s reset workflow
|
|
# By default, cleanup/uninstall is local-only. The `k3s_reset` playbook enables
|
|
# cluster-side node removal explicitly.
|
|
k3s_reset_force_cluster_node_delete: false
|
|
k3s_reset_kubeconfig_path: /etc/rancher/k3s/k3s.yaml
|
|
|
|
# k3s service startup can be slow on first boot (image pulls, containerd unpacking, etc.).
|
|
# The service task is best-effort and then Ansible polls `systemctl is-active` using these knobs.
|
|
k3s_service_start_retries: 60
|
|
k3s_service_start_delay: 5
|
|
|
|
# Destructive repair/refresh workflow (server only)
|
|
# A refresh wipes the k3s installation/state to a blank slate but preserves the
|
|
# join token and CA material so existing agents can rejoin without changing the token.
|
|
k3s_refresh_backup_root: /root/k3s-refresh-backups
|
|
k3s_refresh_confirm: ""
|
|
k3s_refresh_run_configure: true
|
|
|
|
# CloudNative-PG
|
|
# Pin operator/plugin version by default to avoid unanticipated upgrades and load spikes.
|
|
# Upgrades must be explicitly enabled via `k3s_cnpg_upgrade: true`.
|
|
k3s_cnpg_version_default: "1.28.1"
|
|
k3s_cnpg_upgrade: false
|
|
|
|
k3s_role: agent
|
|
k3s_cluster_init: false
|
|
k3s_server_url: ""
|
|
k3s_token: "{{ vault_k3s_token | default('') }}"
|
|
# Optional: if `k3s_token` is a full node-token (`K10...::server:...`), set this
|
|
# to the raw secret (`...` after `::server:`) for the server config.
|
|
k3s_server_token: ""
|
|
k3s_disable: []
|
|
k3s_tls_sans: []
|
|
k3s_service_node_labels: []
|
|
k3s_node_taints: []
|
|
k3s_disable_agent: false
|
|
|
|
# K3s state storage
|
|
# `/var/lib/rancher` is treated as local host storage (not iSCSI/shared).
|
|
k3s_rancher_mountpoint: /var/lib/rancher
|
|
k3s_rancher_storage_class: local
|
|
k3s_data_dir: "{{ k3s_rancher_mountpoint }}/k3s"
|
|
|
|
# Guardrail: when enabled, k3s must not run unless `k3s_rancher_mountpoint` is a
|
|
# dedicated mount (i.e. not backed by the same device as `/`).
|
|
#
|
|
# This is intentionally opt-in because some nodes may legitimately run k3s with
|
|
# `/var/lib/rancher` on the root filesystem.
|
|
k3s_rancher_mount_required: false
|
|
|
|
# If `k3s_rancher_mount_required` is true, these must be set to manage the mount
|
|
# via Ansible (/etc/fstab + mount).
|
|
k3s_rancher_mount_src: ""
|
|
k3s_rancher_mount_fstype: ""
|
|
k3s_rancher_mount_opts: "noatime"
|
|
k3s_rancher_mount_passno: 2
|
|
|
|
k3s_write_kubeconfig_mode: "0640"
|
|
k3s_kubeconfig_group: kubeadm
|
|
k3s_kubeconfig_users: []
|
|
|
|
k3s_registry_config_enabled: true
|
|
k3s_registry_config_path: /etc/rancher/k3s/registries.yaml
|
|
k3s_registry_host: ""
|
|
k3s_registry_namespace: ""
|
|
k3s_registry_port: 5000
|
|
# Internal Prole registry is HTTP by default; set to "https" when TLS is configured.
|
|
k3s_registry_endpoint_scheme: "http"
|
|
|
|
# Pulling large images on every run can cause major load spikes; keep this opt-in.
|
|
k3s_prestage_images: false
|
|
k3s_prestage_images_platform: "linux/arm64"
|
|
k3s_prestage_images_list:
|
|
- docker.io/library/registry:2
|
|
- docker.io/prom/prometheus:v2.55.1
|
|
- docker.io/prom/alertmanager:v0.27.0
|
|
- quay.io/prometheus/node-exporter:v1.8.2
|
|
- quay.io/prometheus-operator/prometheus-operator:v0.71.2
|
|
- ghcr.io/openbao/openbao:2.0.0
|
|
- ghcr.io/opentofu/opentofu:1.8.2
|
|
- docker.io/library/kong:3.8
|
|
|
|
k3s_cert_manager_version: "v1.19.4"
|
|
k3s_service_hostname: "{{ SERVICE_HOSTNAME | default('svc.prole.org') }}"
|
|
k3s_service_cert_name: "{{ k3s_service_hostname | replace('.', '-') }}"
|
|
k3s_service_tls_secret_name: "{{ k3s_service_cert_name }}-tls"
|
|
k3s_service_cluster_issuer: "letsencrypt-prod"
|
|
|
|
# Host firewall: keep svc.prole.org reachable even when Tailscale inserts
|
|
# restrictive filter rules (e.g., `ts-input`/REJECT) near the top of `INPUT`.
|
|
# This role installs a small systemd oneshot that re-applies the rules at boot.
|
|
k3s_firewall_svc_allow_enabled: true
|
|
k3s_firewall_svc_allow_chain: "PROLE-SVC-ALLOW"
|
|
k3s_firewall_svc_allow_tcp_ports:
|
|
- 80
|
|
- 443
|
|
# Traefik NodePorts observed on k3s; keep configurable.
|
|
- 31936
|
|
- 32370
|
|
|
|
# Legacy alias (svc-check used to own svc.prole.org). Keep for backward compatibility.
|
|
k3s_svc_check_domain: "{{ k3s_service_hostname }}"
|
|
k3s_svc_check_namespace: "svc-check"
|
|
k3s_svc_check_kong_namespace: "${SERVICE_NAMESPACE}"
|
|
k3s_svc_check_kong_configmap_name: "prole-svc-kong-config"
|
|
k3s_kong_namespace: "${SERVICE_NAMESPACE}"
|
|
k3s_kong_deployment: "prole-svc-kong"
|