fix: qualify Flux HelmChart bootstrap resources

ansible/roles/rancher-image-prepull/tasks/main.yml

@@ -1,15 +1,19 @@
 ---
 - name: Pre-pull Rancher images into containerd
-  command: /usr/local/bin/ctr -n k8s.io images pull {{ item }}
+  command: timeout 180s /usr/local/bin/ctr -n k8s.io images pull {{ item }}
   register: rancher_image_pull
   loop: "{{ rancher_images_to_prepull }}"
+  retries: 6
+  delay: 20
+  until: rancher_image_pull.rc == 0
   changed_when: rancher_image_pull.rc == 0
   failed_when: false
 
-- name: Report Rancher images that did not pre-pull
+- name: Report Rancher images that did not pre-pull after retries
   debug:
     msg: >-
-      Rancher image pre-pull failed for {{ item.item }}: {{ item.stderr | default('no stderr') }}
+      Best-effort Rancher image pre-pull did not complete for {{ item.item }} after
+      {{ item.attempts | default(1) }} attempt(s): {{ item.stderr | default('no stderr') }}
   loop: "{{ rancher_image_pull.results | default([]) }}"
   loop_control:
     label: "{{ item.item }}"

ansible/roles/tailscale-cleanup/tasks/main.yml

@@ -13,18 +13,19 @@
     - name: Find stale devices matching reserved hostnames
       set_fact:
         stale_devices: >-
-          {{ ts_devices.json.devices | default([])
-             | selectattr('hostname', 'defined')
-             | selectattr('hostname', 'in', tailscale_reserved_hostnames)
-             | rejectattr('online', 'defined')
-             | list
-             +
-             ts_devices.json.devices | default([])
-             | selectattr('hostname', 'defined')
-             | selectattr('hostname', 'in', tailscale_reserved_hostnames)
-             | selectattr('online', 'defined')
-             | rejectattr('online', 'equalto', true)
-             | list }}
+          {{ (ts_devices.json.devices | default([])
+              | selectattr('hostname', 'defined')
+              | selectattr('hostname', 'in', tailscale_reserved_hostnames)
+              | selectattr('connectedToControl', 'defined')
+              | rejectattr('connectedToControl', 'equalto', true)
+              | list
+              +
+              ts_devices.json.devices | default([])
+              | selectattr('hostname', 'defined')
+              | selectattr('hostname', 'in', tailscale_reserved_hostnames)
+              | selectattr('online', 'defined')
+              | rejectattr('online', 'equalto', true)
+              | list) | unique(attribute='id') | list }}
 
     - name: Delete stale devices
       uri: