From a52e2ea72c8351e992907bdbea3a29c587ad52ac Mon Sep 17 00:00:00 2001
From: Timothy Stewart <timothystewart6@gmail.com>
Date: Fri, 31 Jul 2026 14:19:36 -0500
Subject: [PATCH] fix(k3s-server): sequence HA bootstrap

- Wait for the initial control-plane API before starting joining masters\n- Bound and redact k3s-init failure diagnostics
---
 .../k3s_server/tasks/fetch_k3s_init_logs.yml  | 17 ++++++++++++--
 roles/k3s_server/tasks/main.yml               | 22 ++++++++++++++++++-
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/roles/k3s_server/tasks/fetch_k3s_init_logs.yml b/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
index 30bb0071..18e4c341 100644
--- a/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
+++ b/roles/k3s_server/tasks/fetch_k3s_init_logs.yml
@@ -5,12 +5,22 @@
 - name: Fetch k3s-init.service logs
   ansible.builtin.command:
     cmd: >-
-      timeout --signal=TERM 30s journalctl --no-pager
+      timeout --signal=TERM --kill-after=5s 30s journalctl --no-pager
       --unit=k3s-init.service --since=-30min --lines=5000
   changed_when: false
   failed_when: false
   register: k3s_init_log
 
+- name: Fetch k3s-init.service status
+  ansible.builtin.command:
+    cmd: >-
+      timeout --signal=TERM --kill-after=5s 15s systemctl status
+      k3s-init.service --no-pager --full
+  changed_when: false
+  failed_when: false
+  no_log: true
+  register: k3s_init_status
+
 - name: Create {{ log_destination }}
   delegate_to: localhost
   run_once: true
@@ -28,4 +38,7 @@
     dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
     mode: "0644"
   vars:
-    content: "{{ k3s_init_log.stdout }}"
+    content: >-
+      {{ ('=== k3s-init.service status ===\n' + k3s_init_status.stdout
+      + '\n\n=== k3s-init.service journal ===\n' + k3s_init_log.stdout)
+      | regex_replace('--token(?:=|\\s+)[^\\s]+', '--token ***') }}
diff --git a/roles/k3s_server/tasks/main.yml b/roles/k3s_server/tasks/main.yml
index 8ebaad70..f9a0b4a5 100644
--- a/roles/k3s_server/tasks/main.yml
+++ b/roles/k3s_server/tasks/main.yml
@@ -34,10 +34,30 @@
   tags: kubevip
   when: kube_vip_lb_ip_range is defined
 
-- name: Init cluster inside the transient k3s-init service
+- name: Init the first master inside the transient k3s-init service
   ansible.builtin.command:
     cmd: systemd-run -p RestartSec=2 -p Restart=on-failure --unit=k3s-init k3s server {{ server_init_args }}
     creates: "{{ systemd_dir }}/k3s-init.service"
+  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+
+- name: Wait for the first master Kubernetes API before joining other masters
+  ansible.builtin.command:
+    cmd: "{{ k3s_kubectl_binary | default('k3s kubectl') }} get --raw=/readyz"
+  register: first_master_api
+  until: first_master_api.rc == 0
+  retries: "{{ retry_count | default(20) }}"
+  delay: 2
+  changed_when: false
+  run_once: true
+  when: groups[group_name_master | default('master')] | length > 1
+
+- name: Join additional masters inside the transient k3s-init service
+  ansible.builtin.command:
+    cmd: systemd-run -p RestartSec=2 -p Restart=on-failure --unit=k3s-init k3s server {{ server_init_args }}
+    creates: "{{ systemd_dir }}/k3s-init.service"
+  when:
+    - groups[group_name_master | default('master')] | length > 1
+    - ansible_hostname != hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
 
 - name: Verification
   when: not ansible_check_mode