HomeInfra/HetznerTerra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ceefcc3b29d34912b595cf894defd85e848370ab
HetznerTerra/ansible/roles/k3s-server/defaults/main.yml

17 lines
582 B
YAML
Raw Normal View History

feat: Add HA Kubernetes cluster with Terraform + Ansible - 3x CX23 control plane nodes (HA) - 4x CX33 worker nodes - k3s with embedded etcd - Hetzner CCM for load balancers - Gitea CI/CD workflows - Backblaze B2 for Terraform state
2026-02-28 20:24:55 +00:00
---
k3s_version: latest
k3s_token: ""
fix: use private network IPs for k3s join and node addressing
2026-03-01 00:42:55 +00:00
k3s_node_ip: ""
fix: bootstrap k3s HA on private network with dual SANs
2026-03-01 02:45:00 +00:00
k3s_primary_public_ip: ""
fix: prepare k3s for external cloud provider
2026-03-17 01:21:23 +00:00
k3s_disable_embedded_ccm: true
k3s_disable_servicelb: true
Enable Hetzner CCM and CSI for cloud provider integration - Enable --kubelet-arg=cloud-provider=external on all nodes (control planes and workers) - Activate CCM Kustomization with 10m timeout for Hetzner cloud-controller-manager - Activate CSI Kustomization with dependsOn CCM and 10m timeout for hcloud-csi - Update deploy workflow to wait for CCM/CSI readiness (600s timeout) - Add providerID verification to post-deploy health checks This enables proper cloud provider integration with Hetzner CCM for node labeling and Hetzner CSI for persistent volume provisioning.
2026-03-22 22:26:21 +00:00
k3s_kubelet_cloud_provider_external: true
Fix kube_api_endpoint variable passing for HA cluster - Remove circular variable reference in site.yml - Add kube_api_endpoint default to k3s-server role - Variable is set via inventory group_vars and passed to role - Primary CP now correctly adds LB IP to TLS SANs Note: Existing cluster needs destroy/rebuild to regenerate certificates.
2026-03-23 03:01:53 +00:00
# Load Balancer endpoint for HA cluster joins (set in inventory)
kube_api_endpoint: ""
Use Tailscale DNS names instead of IPs for TLS SANs Changed from hardcoded Tailscale IPs to DNS names: - k8s-cluster-cp-1.silverside-gopher.ts.net - k8s-cluster-cp-2.silverside-gopher.ts.net - k8s-cluster-cp-3.silverside-gopher.ts.net This is more robust since Tailscale IPs change on rebuild, but DNS names remain consistent. After next rebuild, cluster accessible via: - kubectl --server=https://k8s-cluster-cp-1.silverside-gopher.ts.net:6443
2026-03-23 23:50:48 +00:00
# Tailscale DNS names for control planes (to enable tailnet access)
# Using DNS names instead of IPs since Tailscale IPs change on rebuild
tailscale_control_plane_names:
- "k8s-cluster-cp-1.silverside-gopher.ts.net"
- "k8s-cluster-cp-2.silverside-gopher.ts.net"
- "k8s-cluster-cp-3.silverside-gopher.ts.net"
Reference in New Issue Copy Permalink