mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 11:44:31 +00:00
26 lines
1.1 KiB
YAML
26 lines
1.1 KiB
YAML
---
|
|
- name: Ensure k3s rancher mount guardrail is opt-in and implemented via systemd drop-in
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
become: false
|
|
|
|
tasks:
|
|
- name: Read k3s install tasks
|
|
ansible.builtin.set_fact:
|
|
_k3s_install_tasks: "{{ lookup('ansible.builtin.file', playbook_dir ~ '/../tasks/install.yml') }}"
|
|
|
|
- name: Assert rancher mount guardrail exists and is opt-in
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (_k3s_install_tasks is search('Guardrail - enforce dedicated rancher mount')) == true
|
|
- (_k3s_install_tasks is search('RequiresMountsFor=')) == true
|
|
- (_k3s_install_tasks is search('k3s_rancher_mountpoint')) == true
|
|
- (_k3s_install_tasks is search('findmnt -n -o SOURCE -T')) == true
|
|
- (_k3s_install_tasks is search('findmnt -n -o SOURCE -T /')) == true
|
|
fail_msg: >-
|
|
k3s role should implement an opt-in guardrail that forces k3s to require
|
|
a dedicated `/var/lib/rancher` mount (via systemd drop-in + preflight),
|
|
without impacting nodes that intentionally keep rancher storage on `/`.
|
|
|
|
# end |