fix: avoid resetting healthy observability

.gitea/workflows/deploy.yml

@@ -9,6 +9,10 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: prod-cluster
+  cancel-in-progress: false
+
 env:
   TF_VERSION: "1.7.0"
   TF_VAR_s3_access_key: ${{ secrets.S3_ACCESS_KEY }}
@@ -1123,17 +1127,6 @@ jobs:
             kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-config --timeout=300s
             kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-backup --timeout=300s
             kubectl -n flux-system wait --for=condition=Ready kustomization/addon-rancher-backup-config --timeout=300s
-            reconcile_at=$(date +%s)
-            for release in kube-prometheus-stack loki promtail; do
-              kubectl -n flux-system annotate "helmrelease/${release}" \
-                reconcile.fluxcd.io/requestedAt="${reconcile_at}" \
-                reconcile.fluxcd.io/resetAt="${reconcile_at}" \
-                reconcile.fluxcd.io/forceAt="${reconcile_at}" \
-                --overwrite
-            done
-            kubectl -n flux-system annotate kustomization/addon-observability \
-              reconcile.fluxcd.io/requestedAt="${reconcile_at}" \
-              --overwrite
             kubectl -n flux-system wait --for=condition=Ready kustomization/addon-observability --timeout=1200s
             kubectl -n flux-system wait --for=condition=Ready kustomization/addon-observability-content --timeout=300s
             kubectl -n flux-system wait --for=condition=Ready helmrelease --all --timeout=1200s

.gitea/workflows/destroy.yml

@@ -8,6 +8,10 @@ on:
         required: true
         default: ''
 
+concurrency:
+  group: prod-cluster
+  cancel-in-progress: false
+
 env:
   TF_VERSION: "1.7.0"
   TF_VAR_s3_access_key: ${{ secrets.S3_ACCESS_KEY }}

ansible/roles/doppler-bootstrap/tasks/main.yml

@@ -15,6 +15,7 @@
     --from-literal=dopplerToken='{{ doppler_hetznerterra_service_token }}'
     --dry-run=client -o yaml | kubectl apply -f -
   changed_when: true
+  no_log: true
 
 - name: Note pending Doppler ClusterSecretStore bootstrap
   debug:

ansible/roles/k3s-agent/tasks/main.yml

@@ -37,8 +37,6 @@
         {% if k3s_kubelet_cloud_provider_external | bool %}--kubelet-arg=cloud-provider=external{% endif %}
       register: k3s_agent_install
       failed_when: false
-      args:
-        creates: /usr/local/bin/k3s-agent
 
 - name: Wait for k3s agent to be ready
   command: systemctl is-active k3s-agent