ansible/roles/k3s-server/defaults/main.yml

---
k3s_version: latest
k3s_token: ""
k3s_node_ip: ""
k3s_primary_public_ip: ""
k3s_disable_embedded_ccm: true
k3s_disable_servicelb: true
k3s_kubelet_cloud_provider_external: true
# Load Balancer endpoint for HA cluster joins (set in inventory)
kube_api_endpoint: ""
# Tailscale IPs for control planes (to enable tailnet access)
tailscale_control_plane_ips:
  - "100.120.55.97"   # cp-1
  - "100.108.90.123"  # cp-2
  - "100.92.149.85"   # cp-3
feat: Add HA Kubernetes cluster with Terraform + Ansible - 3x CX23 control plane nodes (HA) - 4x CX33 worker nodes - k3s with embedded etcd - Hetzner CCM for load balancers - Gitea CI/CD workflows - Backblaze B2 for Terraform state 2026-02-28 20:24:55 +00:00			`---`
			`k3s_version: latest`
			`k3s_token: ""`
fix: use private network IPs for k3s join and node addressing 2026-03-01 00:42:55 +00:00			`k3s_node_ip: ""`
fix: bootstrap k3s HA on private network with dual SANs 2026-03-01 02:45:00 +00:00			`k3s_primary_public_ip: ""`
fix: prepare k3s for external cloud provider 2026-03-17 01:21:23 +00:00			`k3s_disable_embedded_ccm: true`
			`k3s_disable_servicelb: true`
Enable Hetzner CCM and CSI for cloud provider integration - Enable --kubelet-arg=cloud-provider=external on all nodes (control planes and workers) - Activate CCM Kustomization with 10m timeout for Hetzner cloud-controller-manager - Activate CSI Kustomization with dependsOn CCM and 10m timeout for hcloud-csi - Update deploy workflow to wait for CCM/CSI readiness (600s timeout) - Add providerID verification to post-deploy health checks This enables proper cloud provider integration with Hetzner CCM for node labeling and Hetzner CSI for persistent volume provisioning. 2026-03-22 22:26:21 +00:00			`k3s_kubelet_cloud_provider_external: true`
Fix kube_api_endpoint variable passing for HA cluster - Remove circular variable reference in site.yml - Add kube_api_endpoint default to k3s-server role - Variable is set via inventory group_vars and passed to role - Primary CP now correctly adds LB IP to TLS SANs Note: Existing cluster needs destroy/rebuild to regenerate certificates. 2026-03-23 03:01:53 +00:00			`# Load Balancer endpoint for HA cluster joins (set in inventory)`
			`kube_api_endpoint: ""`
Add Tailscale IPs to k3s TLS SANs for secure tailnet access Changes: - Add tailscale_control_plane_ips list to k3s-server defaults - Include all 3 control plane Tailscale IPs (100.120.55.97, 100.108.90.123, 100.92.149.85) - Update primary k3s install to add Tailscale IPs to TLS certificates - Enables kubectl access via Tailscale without certificate errors After next deploy, cluster will be accessible via: - kubectl --server=https://100.120.55.97:6443 (or any CP tailscale IP) - kubectl --server=https://k8s-cluster-cp-1:6443 (via tailscale DNS) 2026-03-23 23:04:00 +00:00			`# Tailscale IPs for control planes (to enable tailnet access)`
			`tailscale_control_plane_ips:`
			`- "100.120.55.97" # cp-1`
			`- "100.108.90.123" # cp-2`
			`- "100.92.149.85" # cp-3`