fix(k3s-server): sequence HA bootstrap

- Wait for the initial control-plane API before starting joining masters\n- Bound and redact k3s-init failure diagnostics

roles/k3s_server/tasks/fetch_k3s_init_logs.yml

@@ -5,12 +5,22 @@
 - name: Fetch k3s-init.service logs
   ansible.builtin.command:
     cmd: >-
-      timeout --signal=TERM 30s journalctl --no-pager
+      timeout --signal=TERM --kill-after=5s 30s journalctl --no-pager
       --unit=k3s-init.service --since=-30min --lines=5000
   changed_when: false
   failed_when: false
   register: k3s_init_log
 
+- name: Fetch k3s-init.service status
+  ansible.builtin.command:
+    cmd: >-
+      timeout --signal=TERM --kill-after=5s 15s systemctl status
+      k3s-init.service --no-pager --full
+  changed_when: false
+  failed_when: false
+  no_log: true
+  register: k3s_init_status
+
 - name: Create {{ log_destination }}
   delegate_to: localhost
   run_once: true
@@ -28,4 +38,7 @@
     dest: "{{ log_destination }}/k3s-init@{{ ansible_hostname }}.log"
     mode: "0644"
   vars:
-    content: "{{ k3s_init_log.stdout }}"
+    content: >-
+      {{ ('=== k3s-init.service status ===\n' + k3s_init_status.stdout
+      + '\n\n=== k3s-init.service journal ===\n' + k3s_init_log.stdout)
+      | regex_replace('--token(?:=|\\s+)[^\\s]+', '--token ***') }}

roles/k3s_server/tasks/main.yml

@@ -34,10 +34,30 @@
   tags: kubevip
   when: kube_vip_lb_ip_range is defined
 
-- name: Init cluster inside the transient k3s-init service
+- name: Init the first master inside the transient k3s-init service
   ansible.builtin.command:
     cmd: systemd-run -p RestartSec=2 -p Restart=on-failure --unit=k3s-init k3s server {{ server_init_args }}
     creates: "{{ systemd_dir }}/k3s-init.service"
+  when: ansible_hostname == hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
+
+- name: Wait for the first master Kubernetes API before joining other masters
+  ansible.builtin.command:
+    cmd: "{{ k3s_kubectl_binary | default('k3s kubectl') }} get --raw=/readyz"
+  register: first_master_api
+  until: first_master_api.rc == 0
+  retries: "{{ retry_count | default(20) }}"
+  delay: 2
+  changed_when: false
+  run_once: true
+  when: groups[group_name_master | default('master')] | length > 1
+
+- name: Join additional masters inside the transient k3s-init service
+  ansible.builtin.command:
+    cmd: systemd-run -p RestartSec=2 -p Restart=on-failure --unit=k3s-init k3s server {{ server_init_args }}
+    creates: "{{ systemd_dir }}/k3s-init.service"
+  when:
+    - groups[group_name_master | default('master')] | length > 1
+    - ansible_hostname != hostvars[groups[group_name_master | default('master')][0]]['ansible_hostname']
 
 - name: Verification
   when: not ansible_check_mode