Nik Afiq
69d880186a
Some checks failed
validate / lint (push) Failing after 1s
host_vars/gpu-node.yaml's ufw_allowed_ports has overridden (not extended) the common role's default list since the node was added, silently dropping the Flannel VXLAN (8472/udp), K3s API (6443/tcp), and Kubelet (10250/tcp) rules every other node gets. Went unnoticed because kubectl logs/exec/stats tunnel through the agent's outbound connection to the k3s server rather than needing a direct inbound path - but real pod dataplane traffic (e.g. tts-gateway on nik-gpu resolving DNS against CoreDNS on nik-debian) needs actual VXLAN connectivity and was blackholing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
64 lines
2.8 KiB
YAML
64 lines
2.8 KiB
YAML
# Host vars for: gpu-node (GPU workstation — spot K3s agent)
|
|
ansible_python_interpreter: /usr/bin/python3.12
|
|
|
|
# ── common ─────────────────────────────────────────────────────────────────────
|
|
timezone: Asia/Tokyo
|
|
username: nik
|
|
|
|
base_packages:
|
|
- curl
|
|
- git
|
|
- htop
|
|
- vim
|
|
- wget
|
|
- ca-certificates
|
|
- gnupg
|
|
- lsb-release
|
|
- build-essential
|
|
|
|
ufw_allowed_ports:
|
|
- { port: "430", proto: tcp, comment: "SSH" }
|
|
- { port: "11434", proto: tcp, comment: "Ollama API" }
|
|
- { port: "61208", proto: tcp, comment: "Glances web UI" }
|
|
# host_vars replaces (not merges) the common role's ufw_allowed_ports
|
|
# default, so the K3s/flannel ports below must be repeated here - without
|
|
# them, cross-node pod traffic (e.g. DNS to CoreDNS on nik-debian) blackholes
|
|
# even though kubectl logs/exec/stats still work (those tunnel through the
|
|
# agent's outbound connection to the k3s server on 6443, not a direct
|
|
# inbound connection).
|
|
- { port: "6443", proto: tcp, comment: "K3s API server" }
|
|
- { port: "10250", proto: tcp, comment: "Kubelet" }
|
|
- { port: "8472", proto: udp, comment: "Flannel VXLAN" }
|
|
|
|
data_dirs:
|
|
- /data/tts-gateway
|
|
|
|
# ── nvidia ─────────────────────────────────────────────────────────────────────
|
|
nvidia_driver_version: "570"
|
|
cuda_version: "12-8"
|
|
|
|
# ── k3s-agent ──────────────────────────────────────────────────────────────────
|
|
k3s_server_url: "https://192.168.7.77:6443"
|
|
k3s_node_token: "{{ vault_k3s_node_token }}"
|
|
|
|
# Check current cluster version with: k3s --version on minisforum
|
|
# Kept in sync with roles/k3s-server and roles/k3s-agent defaults — all three
|
|
# must match; see ansible/README.md "K3s version" note.
|
|
k3s_version: "v1.32.4+k3s1"
|
|
|
|
k3s_node_labels:
|
|
node-role: gpu
|
|
nik4nao.com/node-type: spot
|
|
nik4nao.com/gpu: "true"
|
|
|
|
k3s_node_taints:
|
|
- "spot=true:NoSchedule"
|
|
|
|
# ── ollama ─────────────────────────────────────────────────────────────────────
|
|
ollama_port: 11434
|
|
ollama_models:
|
|
- qwen3:4b
|
|
ollama_models_dir: /usr/share/ollama/.ollama/models
|
|
|
|
# ── glances ────────────────────────────────────────────────────────────────────
|
|
# no extra vars — uses role defaults |