From fb9a0bebd1e9e5d9d12f5fcbbc81fe0fc7bb60a2 Mon Sep 17 00:00:00 2001
From: Timothy Stewart <timothystewart6@gmail.com>
Date: Sat, 1 Aug 2026 00:21:57 -0500
Subject: [PATCH] fix(molecule): stabilize host-only peer identity

- restore host-only routing required by outside verification
- assign deterministic adapter MACs to the five default guests
- pin disposable full-mesh neighbor entries from live Ansible facts
---
 molecule/default/molecule.yml | 19 ++++++++++++-------
 molecule/default/prepare.yml  | 25 ++++++++++++++++++++-----
 2 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
index 1373a2a..51f418d 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -14,12 +14,13 @@ platforms:
     groups:
       - k3s_cluster
       - master
+    # Keep adapter 2 stable across linked-clone rebuilds so stale host-only
+    # neighbor state still identifies the current scenario guest.
+    provider_raw_config_args:
+      - "customize ['modifyvm', :id, '--mac-address2', '080027A13038']"
     interfaces:
       - network_name: private_network
         ip: 192.168.30.38
-        # Keep this cluster off the persistent vboxnet0 host-only switch. The
-        # NAT adapter remains available for SSH and Internet access.
-        virtualbox__intnet: k3s-ansible-default
     config_options:
       # We currently can not use public-key based authentication on Ubuntu 22.04,
       # see: https://github.com/chef/bento/issues/1405
@@ -33,10 +34,11 @@ platforms:
     groups:
       - k3s_cluster
       - master
+    provider_raw_config_args:
+      - "customize ['modifyvm', :id, '--mac-address2', '080027A13039']"
     interfaces:
       - network_name: private_network
         ip: 192.168.30.39
-        virtualbox__intnet: k3s-ansible-default
 
   - name: control3
     box: generic/rocky9
@@ -45,10 +47,11 @@ platforms:
     groups:
       - k3s_cluster
       - master
+    provider_raw_config_args:
+      - "customize ['modifyvm', :id, '--mac-address2', '080027A13040']"
     interfaces:
       - network_name: private_network
         ip: 192.168.30.40
-        virtualbox__intnet: k3s-ansible-default
 
   - name: node1
     box: generic/ubuntu2204
@@ -57,10 +60,11 @@ platforms:
     groups:
       - k3s_cluster
       - node
+    provider_raw_config_args:
+      - "customize ['modifyvm', :id, '--mac-address2', '080027A13041']"
     interfaces:
       - network_name: private_network
         ip: 192.168.30.41
-        virtualbox__intnet: k3s-ansible-default
     config_options:
       # We currently can not use public-key based authentication on Ubuntu 22.04,
       # see: https://github.com/chef/bento/issues/1405
@@ -74,10 +78,11 @@ platforms:
     groups:
       - k3s_cluster
       - node
+    provider_raw_config_args:
+      - "customize ['modifyvm', :id, '--mac-address2', '080027A13042']"
     interfaces:
       - network_name: private_network
         ip: 192.168.30.42
-        virtualbox__intnet: k3s-ansible-default
 
 provisioner:
   name: ansible
diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml
index 268f296..a9da69c 100644
--- a/molecule/default/prepare.yml
+++ b/molecule/default/prepare.yml
@@ -49,19 +49,34 @@
           The Vagrant private interface {{ flannel_iface }} does not have an
           IPv4 address on {{ inventory_hostname }}.
 
-    - name: Clear cached primary neighbor entry
+    - name: Pin disposable cluster peer neighbor entries
       ansible.builtin.command:
         argv:
           - ip
           - neigh
-          - flush
-          - to
-          - "{{ primary_cluster_ip }}"
+          - replace
+          - "{{ peer_cluster_ip }}"
+          - lladdr
+          - "{{ peer_cluster_mac }}"
+          - nud
+          - permanent
           - dev
           - "{{ cluster_interface }}"
       become: true
       changed_when: false
-      when: inventory_hostname != primary_master
+      loop: "{{ groups['k3s_cluster'] }}"
+      loop_control:
+        label: "{{ inventory_hostname }} -> {{ item }}"
+      vars:
+        peer_cluster_interface: >-
+          {{ hostvars[item].cilium_iface
+          | default(hostvars[item].calico_iface
+          | default(hostvars[item].flannel_iface)) }}
+        peer_cluster_ip: >-
+          {{ hostvars[item].k3s_node_ip | split(',') | first }}
+        peer_cluster_mac: >-
+          {{ hostvars[item].ansible_facts[peer_cluster_interface].macaddress }}
+      when: item != inventory_hostname
 
     - name: Verify guest-to-guest cluster network reachability
       ansible.builtin.command: