---
# Rolls a "reboot required" flag left by unattended-upgrades
# (roles/unattended_upgrades, Automatic-Reboot disabled) into an actual
# reboot, one node at a time — cordon, drain, reboot, wait for Ready,
# uncordon — so patching the OS never means dropping every workload on the
# cluster at once. A no-op on any node that isn't carrying a pending reboot.
#
# serial: 1 is the point of this playbook: exactly one node is ever down for
# maintenance at a time, whatever `--limit` narrows the run to.
#
# Host order matters here and isn't left to inventory.yml's own group
# order (control plane, then workers) — reversed below so workers are
# rebooted while the API server is still up on the control plane, and the
# control plane's own reboot (which drops the API for everyone, single-server
# cluster, no HA) happens last rather than first.
#
# Manual-only for now, like playbooks/k3s.yml — run by hand:
#
#   ansible-playbook playbooks/k3s_maintenance.yml
#
# Intended to eventually run on a schedule from a self-hosted Forgejo Actions
# runner (a `schedule:`-triggered workflow, same runner as
# .forgejo/workflows/deploy.yml) rather than by hand — not wired up yet, but
# the SSH key import below is what makes that possible without also handing
# the runner an ssh-agent.

# Same first play as k3s.yml — the key comes from Vault, and this playbook is
# routinely run on its own, so it can't rely on a k3s.yml run having fetched
# it. See k3s_ssh_key.yml.
- ansible.builtin.import_playbook: k3s_ssh_key.yml

- name: Roll pending reboots across the k3s cluster
  hosts: k3s_workers:k3s_control_plane
  gather_facts: true
  serial: 1
  roles:
    - k3s_maintenance