37 lines
1.6 KiB
YAML
37 lines
1.6 KiB
YAML
---
|
|
# Rolls a "reboot required" flag left by unattended-upgrades
|
|
# (roles/unattended_upgrades, Automatic-Reboot disabled) into an actual
|
|
# reboot, one node at a time — cordon, drain, reboot, wait for Ready,
|
|
# uncordon — so patching the OS never means dropping every workload on the
|
|
# cluster at once. A no-op on any node that isn't carrying a pending reboot.
|
|
#
|
|
# serial: 1 is the point of this playbook: exactly one node is ever down for
|
|
# maintenance at a time, whatever `--limit` narrows the run to.
|
|
#
|
|
# Host order matters here and isn't left to inventory.yml's own group
|
|
# order (control plane, then workers) — reversed below so workers are
|
|
# rebooted while the API server is still up on the control plane, and the
|
|
# control plane's own reboot (which drops the API for everyone, single-server
|
|
# cluster, no HA) happens last rather than first.
|
|
#
|
|
# Manual-only for now, like playbooks/k3s.yml — run by hand:
|
|
#
|
|
# ansible-playbook playbooks/k3s_maintenance.yml
|
|
#
|
|
# Intended to eventually run on a schedule from a self-hosted Forgejo Actions
|
|
# runner (a `schedule:`-triggered workflow, same runner as
|
|
# .forgejo/workflows/deploy.yml) rather than by hand — not wired up yet, but
|
|
# the SSH key import below is what makes that possible without also handing
|
|
# the runner an ssh-agent.
|
|
|
|
# Same first play as k3s.yml — the key comes from Vault, and this playbook is
|
|
# routinely run on its own, so it can't rely on a k3s.yml run having fetched
|
|
# it. See k3s_ssh_key.yml.
|
|
- ansible.builtin.import_playbook: k3s_ssh_key.yml
|
|
|
|
- name: Roll pending reboots across the k3s cluster
|
|
hosts: k3s_workers:k3s_control_plane
|
|
gather_facts: true
|
|
serial: 1
|
|
roles:
|
|
- k3s_maintenance
|