c16e7cf740
Primary server detection previously used ansible_default_ipv4.address compared against k3s_primary_server_ip, which breaks with --limit since facts are only gathered for the targeted hosts, causing the variable to resolve to the wrong IP. - Replace IP comparisons with `inventory_hostname == groups['k3s_server'] | first` in main.yaml (primary install, secondary install, kubeconfig tasks) - Delegate the node-token slurp to the primary server unconditionally so pull_token.yaml works correctly when run against any single node with --limit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
27 lines
800 B
YAML
27 lines
800 B
YAML
- name: Get K3s token from the primary server
|
|
ansible.builtin.slurp:
|
|
src: /var/lib/rancher/k3s/server/node-token
|
|
register: k3s_token_raw
|
|
delegate_to: "{{ groups['k3s_server'] | first }}"
|
|
run_once: true
|
|
become: true
|
|
|
|
- name: Set k3s_token fact
|
|
ansible.builtin.set_fact:
|
|
k3s_token: "{{ k3s_token_raw['content'] | b64decode | trim }}"
|
|
run_once: true
|
|
|
|
- name: Write K3s token to local file for encryption
|
|
ansible.builtin.copy:
|
|
content: |
|
|
k3s_token: "{{ k3s_token }}"
|
|
dest: "{{ playbook_dir }}/{{ k3s_server_token_vault_file }}"
|
|
mode: "0600"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
|
|
- name: Encrypt k3s token
|
|
ansible.builtin.shell: cd ../; ansible-vault encrypt "{{ playbook_dir }}/{{ k3s_server_token_vault_file }}"
|
|
delegate_to: localhost
|
|
run_once: true
|