From f9bc53723fd07f0575eac5e462067c2e97bdc1a7 Mon Sep 17 00:00:00 2001
From: MichaelFisher1997 <contact@michaelfisher.tech>
Date: Thu, 23 Apr 2026 06:41:21 +0000
Subject: [PATCH] fix: make image pre-pull roles fully best effort

The pre-pull roles were still blocking the playbook because they retried until
success and exhausted their retry budget during registry TLS timeouts. Keep the
image pulls as opportunistic cache warmers, but never let them fail the
bootstrap; log any missed images instead.
---
 .../roles/bootstrap-image-prepull/tasks/main.yml   | 14 ++++++++++----
 ansible/roles/rancher-image-prepull/tasks/main.yml | 14 ++++++++++----
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/ansible/roles/bootstrap-image-prepull/tasks/main.yml b/ansible/roles/bootstrap-image-prepull/tasks/main.yml
index d331d42..17507ca 100644
--- a/ansible/roles/bootstrap-image-prepull/tasks/main.yml
+++ b/ansible/roles/bootstrap-image-prepull/tasks/main.yml
@@ -2,9 +2,15 @@
 - name: Pre-pull bootstrap images into containerd
   command: /usr/local/bin/ctr -n k8s.io images pull {{ item }}
   register: bootstrap_image_pull
-  retries: 12
-  delay: 15
-  until: bootstrap_image_pull.rc == 0
   loop: "{{ bootstrap_prepull_images }}"
-  changed_when: true
+  changed_when: bootstrap_image_pull.rc == 0
   failed_when: false
+
+- name: Report bootstrap images that did not pre-pull
+  debug:
+    msg: >-
+      Bootstrap image pre-pull failed for {{ item.item }}: {{ item.stderr | default('no stderr') }}
+  loop: "{{ bootstrap_image_pull.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: item.rc is defined and item.rc != 0
diff --git a/ansible/roles/rancher-image-prepull/tasks/main.yml b/ansible/roles/rancher-image-prepull/tasks/main.yml
index 3f9ee9e..319a411 100644
--- a/ansible/roles/rancher-image-prepull/tasks/main.yml
+++ b/ansible/roles/rancher-image-prepull/tasks/main.yml
@@ -2,9 +2,15 @@
 - name: Pre-pull Rancher images into containerd
   command: /usr/local/bin/ctr -n k8s.io images pull {{ item }}
   register: rancher_image_pull
-  retries: 5
-  delay: 15
-  until: rancher_image_pull.rc == 0
   loop: "{{ rancher_images_to_prepull }}"
-  changed_when: true
+  changed_when: rancher_image_pull.rc == 0
   failed_when: false
+
+- name: Report Rancher images that did not pre-pull
+  debug:
+    msg: >-
+      Rancher image pre-pull failed for {{ item.item }}: {{ item.stderr | default('no stderr') }}
+  loop: "{{ rancher_image_pull.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: item.rc is defined and item.rc != 0