k3s-config: SSM public-IP lookup and its gate are vestigial once Traefik is ClusterIP #942

New issue

Open

opened 2026-08-26 03:00:23 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-26 03:00:23 +00:00

Owner

Deferred out of #941 deliberately, recording it so it does not just disappear.

What is now unused

#941 moves Traefik to hostNetwork with a ClusterIP Service, so the rendered HelmChartConfig no longer contains loadBalancerIP. That leaves the following in ansible/roles/k3s-config with nothing consuming their output:

k3s_traefik_load_balancer_ip_ssm (/coilysiren/home/public-ip) and the shell lookup that reads it
k3s_traefik_load_balancer_ip / k3s_traefik_load_balancer_ip_value
k3s_traefik_load_balancer_ip_available, and the four tasks gated on it (assert, debug, the set_fact, the manifest-dir file task, and the template task itself)

Why it was left in place

It fails safe. When the lookup cannot resolve, the role preserves the existing config file rather than writing an empty value, and the assert blocks first-time provisioning without an address. So the vestigial path degrades to "change nothing", which is the correct direction to fail.

It was also not worth mixing a role refactor into #941, which restarts cluster-wide ingress and wanted to stay reviewable in isolation.

Why it should still be cleaned up

The gate now reads as though the Traefik config depends on the public IP, and it does not. That is the same shape as the two drift bugs found on 2026-08-26: a stale authoring layer whose intent no longer matches what it produces. Someone reading this role later will reasonably infer the IP still matters.

There is also a live coupling worth removing rather than reasoning about: if SSM becomes unreachable, the role skips writing the Traefik config entirely. Today that preserves a correct file. It would silently skip a changed config too.

What to do

Remove the SSM lookup, the derived facts, and the gate, so the template is written unconditionally. Confirm first that no other task or template in the role consumes k3s_traefik_load_balancer_ip_value, and that nothing outside the role reads /coilysiren/home/public-ip for a different purpose. The SSM parameter itself is still the source of truth for the external-dns.alpha.kubernetes.io/target annotations on the ingresses, so the parameter stays even if this role stops reading it.

Do not land this while #941 is unmerged: the two touch the same tasks file.

Deferred out of #941 deliberately, recording it so it does not just disappear. ## What is now unused #941 moves Traefik to `hostNetwork` with a `ClusterIP` Service, so the rendered `HelmChartConfig` no longer contains `loadBalancerIP`. That leaves the following in `ansible/roles/k3s-config` with nothing consuming their output: * `k3s_traefik_load_balancer_ip_ssm` (`/coilysiren/home/public-ip`) and the shell lookup that reads it * `k3s_traefik_load_balancer_ip` / `k3s_traefik_load_balancer_ip_value` * `k3s_traefik_load_balancer_ip_available`, and the four tasks gated on it (`assert`, `debug`, the `set_fact`, the manifest-dir `file` task, and the `template` task itself) ## Why it was left in place It fails safe. When the lookup cannot resolve, the role preserves the existing config file rather than writing an empty value, and the `assert` blocks first-time provisioning without an address. So the vestigial path degrades to "change nothing", which is the correct direction to fail. It was also not worth mixing a role refactor into #941, which restarts cluster-wide ingress and wanted to stay reviewable in isolation. ## Why it should still be cleaned up The gate now reads as though the Traefik config depends on the public IP, and it does not. That is the same shape as the two drift bugs found on 2026-08-26: a stale authoring layer whose intent no longer matches what it produces. Someone reading this role later will reasonably infer the IP still matters. There is also a live coupling worth removing rather than reasoning about: if SSM becomes unreachable, the role skips writing the Traefik config entirely. Today that preserves a correct file. It would silently skip a *changed* config too. ## What to do Remove the SSM lookup, the derived facts, and the gate, so the template is written unconditionally. Confirm first that no other task or template in the role consumes `k3s_traefik_load_balancer_ip_value`, and that nothing outside the role reads `/coilysiren/home/public-ip` for a different purpose. The SSM parameter itself is still the source of truth for the `external-dns.alpha.kubernetes.io/target` annotations on the ingresses, so the parameter stays even if this role stops reading it. Do not land this while #941 is unmerged: the two touch the same tasks file.

coilyco-ops added this to the Networking and DNS milestone

2026-08-29 06:09:29 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#942

No description provided.

Rows
Columns