# config.yaml is edited in place, not templated: the live files carry hand
# settings the template does not know. k3s reads them on its next restart,
# which stays manual so etcd members restart one at a time.

- name: Kubelet image garbage collection
  tags: kubelet_gc
  block:
    - name: Create the kubelet drop-in directory
      file:
        path: /etc/rancher/k3s/kubelet.conf.d
        state: directory
        mode: "0755"

    - name: Set the image garbage collection thresholds
      copy:
        dest: /etc/rancher/k3s/kubelet.conf.d/10-image-gc.conf
        mode: "0644"
        content: |
          apiVersion: kubelet.config.k8s.io/v1beta1
          kind: KubeletConfiguration
          imageGCHighThresholdPercent: 70
          imageGCLowThresholdPercent: 55
          imageMaximumGCAge: 168h

    - name: Declare the kubelet-arg list in the k3s config
      lineinfile:
        path: /etc/rancher/k3s/config.yaml
        regexp: '^kubelet-arg:'
        line: 'kubelet-arg:'

    - name: Point the kubelet at the drop-in directory
      lineinfile:
        path: /etc/rancher/k3s/config.yaml
        regexp: '^\s*- config-dir='
        line: '  - config-dir=/etc/rancher/k3s/kubelet.conf.d'
        insertafter: '^kubelet-arg:'

# Every pod watching its config files takes inotify instances and watches from
# the per-user pool. An LXC container inherits these from its host. Only this
# file is loaded: sysctl --system would also apply distribution defaults such as
# rp_filter that differ from the live values Cilium relies on.
- name: Raise the inotify limits
  tags: inotify
  when: ansible_facts['virtualization_type'] != 'lxc'
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    sysctl_file: /etc/sysctl.d/90-inotify.conf
  loop: "{{ {'fs.inotify.max_user_instances': 65536, 'fs.inotify.max_user_watches': 4194304} | dict2items }}"

# Without it etcd serves metrics on 127.0.0.1 only, out of reach of vmagent.
- name: Expose the etcd metrics on the node IP
  tags: etcd_metrics
  when: not (kubernetes.config_extra['disable-etcd'] | default(false))
  lineinfile:
    path: /etc/rancher/k3s/config.yaml
    regexp: '^etcd-expose-metrics:'
    line: 'etcd-expose-metrics: true'