mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 19:54:32 +00:00
5dcd3b9581
Update inventory/roles to keep K3s state on local storage and prevent iSCSI from managing /var/lib/rancher. Also add a single-host k3s install playbook, a systemd override template, and docs describing the installer ↔ Ansible boundary and slow-storage knobs. Co-authored-by: Junie <junie@jetbrains.com>
51 lines
2.5 KiB
Markdown
51 lines
2.5 KiB
Markdown
### Installer ↔ Ansible boundary
|
|
|
|
`install.py` (and the `installer/` package) and Ansible are treated as **independent tools**.
|
|
|
|
- The installer may *invoke* `ansible` / `ansible-playbook` as an external subprocess.
|
|
- The installer must not assume:
|
|
- Ansible vault access
|
|
- inventory parsing as a required part of the workflow
|
|
- any specific private repo checkout layout (e.g. a sibling `prole/infrastructure`)
|
|
- Ansible playbooks/roles must not assume `install.py` is discovering secrets or passing hidden, repo-local state.
|
|
|
|
This is designed so private inventory/secret material can live entirely in `prole/infrastructure` (or elsewhere) without this repo requiring it.
|
|
|
|
#### Explicit inputs (recommended)
|
|
|
|
When the installer needs to call `ansible-playbook` (for example to fetch a kubeconfig), provide paths explicitly via environment variables:
|
|
|
|
- `PROLE_ANSIBLE_K3S_FETCH_KUBECONFIG_PLAYBOOK`
|
|
- Full path to `k3s_fetch_kubeconfig.yml`.
|
|
- `PROLE_ANSIBLE_PLAYBOOKS_DIR` (or `PROLE_ANSIBLE_PLAYBOOK_DIR`)
|
|
- Directory that contains `k3s_fetch_kubeconfig.yml`.
|
|
- `PROLE_ANSIBLE_INVENTORY` (or `ANSIBLE_INVENTORY`)
|
|
- Inventory path passed as `ansible-playbook -i ...`.
|
|
- `PROLE_ANSIBLE_VAULT_PASSWORD_FILE` (or `ANSIBLE_VAULT_PASSWORD_FILE`)
|
|
- Vault password file path passed as `ansible-playbook --vault-password-file ...`.
|
|
- `PROLE_ANSIBLE_CONFIG` (or `ANSIBLE_CONFIG`)
|
|
- Path to an Ansible config file to use for the subprocess.
|
|
|
|
Separately, when the deployment workflow needs k3s connection info, provide it explicitly:
|
|
|
|
- `PROLE_K3S_SERVER`
|
|
- `PROLE_K3S_TOKEN` (or `K3S_TOKEN`)
|
|
|
|
#### Optional legacy auto-detection (opt-in)
|
|
|
|
For local developer convenience only, repo-relative discovery can be enabled explicitly:
|
|
|
|
- `PROLE_ANSIBLE_AUTO_DETECT=true`
|
|
|
|
When enabled, some flows may look for legacy repo-relative playbooks (under `infrastructure/playbooks/`). This is **not** required for normal operation and should not be relied on for private infrastructure.
|
|
|
|
### K3s slow-storage tolerance knobs (Ansible)
|
|
|
|
The `infrastructure/roles/k3s` role exposes configurable defaults intended for slow storage (Pi / USB) rollouts:
|
|
|
|
- `k3s_kubelet_args` (default includes `runtime-request-timeout=15m`, `image-pull-progress-deadline=15m`, `node-status-update-frequency=20s`)
|
|
- `k3s_systemd_override_enabled` (default `true`)
|
|
- `k3s_systemd_timeout_start_sec` (default `15min`)
|
|
- `k3s_systemd_timeout_stop_sec` (default `10min`)
|
|
- `k3s_systemd_restart` (default `always`)
|
|
- `k3s_systemd_restart_sec` (default `15s`) |