mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:04:31 +00:00
ec8a4e98af
- Implement proactive CA hash verification and automated repair for mismatches - Ensure agents prioritize discovered server tokens over stale vault values - Fix K3s service hangs with explicit stop and killall before reinstall - Add Retropie/Pi networking fixes (WiFi power save, wlan0 priority) - Pin pre-staged images to stable, architecture-aware versions (arm64) - Remove obsolete init-port-forwards and prole.cfg sync tasks - Update k8s manifests and installer core logic with new tests
74 lines
2.6 KiB
YAML
74 lines
2.6 KiB
YAML
---
|
|
- name: Update k3s vault token on controller
|
|
block:
|
|
- name: Set vault k3s path
|
|
ansible.builtin.set_fact:
|
|
vault_k3s_path: "{{ role_path }}/../../inventory/group_vars/all/vault_k3s.yml"
|
|
vault_pass_default: "{{ role_path }}/../../../.vault_pass"
|
|
|
|
- name: Determine vault password file
|
|
ansible.builtin.set_fact:
|
|
k3s_vault_password_file: >-
|
|
{{ k3s_vault_password_file
|
|
| default(lookup('env', 'ANSIBLE_VAULT_PASSWORD_FILE') | default('', true), true) }}
|
|
delegate_to: localhost
|
|
delegate_facts: true
|
|
|
|
- name: Check for default vault password file
|
|
ansible.builtin.stat:
|
|
path: "{{ vault_pass_default }}"
|
|
register: vault_pass_default_stat
|
|
delegate_to: localhost
|
|
|
|
- name: Fallback to default vault password file
|
|
ansible.builtin.set_fact:
|
|
k3s_vault_password_file: "{{ vault_pass_default }}"
|
|
when:
|
|
- (hostvars['localhost'].k3s_vault_password_file | default('')) | length == 0
|
|
- vault_pass_default_stat.stat.exists
|
|
delegate_to: localhost
|
|
delegate_facts: true
|
|
|
|
- name: Check if vault file is encrypted
|
|
ansible.builtin.command: "head -n 1 {{ vault_k3s_path }}"
|
|
register: vault_k3s_head
|
|
changed_when: false
|
|
delegate_to: localhost
|
|
failed_when: false
|
|
|
|
- name: Mark vault encryption state
|
|
ansible.builtin.set_fact:
|
|
vault_k3s_encrypted: "{{ (vault_k3s_head.stdout | default('')) is search('^\\$ANSIBLE_VAULT') }}"
|
|
delegate_to: localhost
|
|
delegate_facts: true
|
|
|
|
- name: Decrypt vault_k3s.yml
|
|
ansible.builtin.command: >-
|
|
ansible-vault decrypt {{ vault_k3s_path }}
|
|
--vault-password-file {{ hostvars['localhost'].k3s_vault_password_file }}
|
|
changed_when: true
|
|
delegate_to: localhost
|
|
when:
|
|
- hostvars['localhost'].vault_k3s_encrypted | default(false)
|
|
- (hostvars['localhost'].k3s_vault_password_file | default('')) | length > 0
|
|
|
|
- name: Update vault k3s token
|
|
ansible.builtin.lineinfile:
|
|
path: "{{ vault_k3s_path }}"
|
|
regexp: '^vault_k3s_token:'
|
|
line: "vault_k3s_token: \"{{ k3s_token_discovered }}\""
|
|
create: true
|
|
mode: "0644"
|
|
delegate_to: localhost
|
|
|
|
- name: Encrypt vault_k3s.yml
|
|
ansible.builtin.command: >-
|
|
ansible-vault encrypt {{ vault_k3s_path }}
|
|
--vault-password-file {{ hostvars['localhost'].k3s_vault_password_file }}
|
|
changed_when: true
|
|
delegate_to: localhost
|
|
when:
|
|
- hostvars['localhost'].vault_k3s_encrypted | default(false)
|
|
- (hostvars['localhost'].k3s_vault_password_file | default('')) | length > 0
|
|
run_once: true
|