Initial VPS operations handbook

ansible/roles/k3s_server/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# The installer downloads the current stable channel only for an uninstalled node.
+# Normal reruns never auto-upgrade an existing K3s installation.
+k3s_install_enabled: false
+k3s_install_url: https://get.k3s.io
+k3s_binary_path: /usr/local/bin/k3s
+k3s_service_name: k3s
+k3s_server_args:
+  - --disable=servicelb
+  - --disable=metrics-server
+k3s_kubeconfig: /etc/rancher/k3s/k3s.yaml

ansible/roles/k3s_server/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+- name: Check whether K3s is installed
+  ansible.builtin.stat:
+    path: "{{ k3s_binary_path }}"
+  register: k3s_server_binary
+
+- name: Require explicit approval before first K3s installation
+  ansible.builtin.assert:
+    that:
+      - k3s_install_enabled | bool
+    fail_msg: >-
+      Refusing first-time K3s installation. Re-run only after preflight succeeds
+      with k3s_install_enabled=true.
+  when: not (k3s_server_binary.stat.exists | bool)
+
+- name: Install current stable K3s only on a new node
+  ansible.builtin.shell:
+    cmd: >-
+      curl -fsSL {{ k3s_install_url }} |
+      INSTALL_K3S_EXEC='server {{ k3s_server_args | join(' ') }}' sh -
+    creates: "{{ k3s_binary_path }}"
+  when: not (k3s_server_binary.stat.exists | bool)
+  no_log: true
+
+- name: Wait for K3s API readiness
+  ansible.builtin.command:
+    argv:
+      - "{{ k3s_binary_path }}"
+      - kubectl
+      - get
+      - node
+      - --output=jsonpath={.items[0].status.conditions[?(@.type=="Ready")].status}
+  changed_when: false
+  register: k3s_server_ready
+  retries: 30
+  delay: 5
+  until: k3s_server_ready.stdout == 'True'
+
+- name: Assert Traefik is installed and K3s optional components remain disabled
+  ansible.builtin.command:
+    argv:
+      - "{{ k3s_binary_path }}"
+      - kubectl
+      - get
+      - deployment
+      - traefik
+      - --namespace=kube-system
+  changed_when: false