fix(molecule): stabilize default scenario networking

- serialize five-node Vagrant creation to avoid VirtualBox host-only races
- refresh and verify the primary neighbor mapping before convergence
- include interface MAC details in failure diagnostics

molecule/default/molecule.yml

@@ -3,6 +3,11 @@ dependency:
   name: galaxy
 driver:
   name: vagrant
+  # The Vagrant driver warns that parallel VirtualBox creation can cause
+  # platform issues. This five-node, mixed-distribution scenario is especially
+  # susceptible to stale host-only-network neighbor state when all guests are
+  # created concurrently.
+  parallel: false
 platforms:
   - name: control1
     box: generic/ubuntu2204

molecule/default/prepare.yml

@@ -5,6 +5,18 @@
 
 - name: Network setup
   hosts: all
+  vars:
+    primary_master: "{{ groups[group_name_master | default('master')][0] }}"
+    primary_cluster_ip: >-
+      {{ hostvars[primary_master].k3s_node_ip | split(',') | first }}
+    cluster_interface: >-
+      {{ cilium_iface | default(calico_iface | default(flannel_iface)) }}
+    primary_cluster_interface: >-
+      {{ hostvars[primary_master].cilium_iface
+      | default(hostvars[primary_master].calico_iface
+      | default(hostvars[primary_master].flannel_iface)) }}
+    primary_cluster_mac: >-
+      {{ hostvars[primary_master].ansible_facts[primary_cluster_interface].macaddress }}
   tasks:
     - name: Gather service facts
       ansible.builtin.service_facts:
@@ -37,6 +49,20 @@
           The Vagrant private interface {{ flannel_iface }} does not have an
           IPv4 address on {{ inventory_hostname }}.
 
+    - name: Clear cached primary neighbor entry
+      ansible.builtin.command:
+        argv:
+          - ip
+          - neigh
+          - flush
+          - to
+          - "{{ primary_cluster_ip }}"
+          - dev
+          - "{{ cluster_interface }}"
+      become: true
+      changed_when: false
+      when: inventory_hostname != primary_master
+
     - name: Verify guest-to-guest cluster network reachability
       ansible.builtin.command:
         argv:
@@ -45,15 +71,37 @@
           - "1"
           - -W
           - "1"
-          - >-
+          - "{{ primary_cluster_ip }}"
-            {{ hostvars[groups[group_name_master | default('master')][0]].k3s_node_ip
-            | split(',') | first }}
       register: primary_cluster_ping
       until: primary_cluster_ping.rc == 0
       retries: 6
       delay: 2
       changed_when: false
 
+    - name: Read the primary neighbor entry
+      ansible.builtin.command:
+        argv:
+          - ip
+          - neigh
+          - show
+          - to
+          - "{{ primary_cluster_ip }}"
+          - dev
+          - "{{ cluster_interface }}"
+      register: primary_cluster_neighbor
+      changed_when: false
+      when: inventory_hostname != primary_master
+
+    - name: Verify the primary neighbor identity
+      ansible.builtin.assert:
+        that:
+          - (primary_cluster_mac | lower) in (primary_cluster_neighbor.stdout | lower)
+        fail_msg: >-
+          {{ inventory_hostname }} resolved primary {{ primary_cluster_ip }} to
+          an unexpected MAC on {{ cluster_interface }}. Expected
+          {{ primary_cluster_mac }}, got: {{ primary_cluster_neighbor.stdout }}
+      when: inventory_hostname != primary_master
+
     - name: Verify GitHub release host DNS
       ansible.builtin.getent:
         database: hosts

roles/k3s_server/tasks/fetch_k3s_init_logs.yml

@@ -30,6 +30,14 @@
   no_log: true
   register: k3s_ip_address_state
 
+- name: Fetch IP link state
+  ansible.builtin.command:
+    cmd: ip -br link
+  changed_when: false
+  failed_when: false
+  no_log: true
+  register: k3s_ip_link_state
+
 - name: Fetch IP route state
   ansible.builtin.command:
     cmd: ip route show
@@ -136,6 +144,9 @@
       === ip -br address ===
       {{ k3s_ip_address_state.stdout }}
 
+      === ip -br link ===
+      {{ k3s_ip_link_state.stdout }}
+
       === ip route show ===
       {{ k3s_ip_route_state.stdout }}