eSlider
9f99d132e3
Non-root drone pods need write access on the hostPath lake. Ansible now creates var/t1 and var/t3 owned by uid 10001 instead of relying on 0777 alone after legacy root-owned parquet trees.
Ansible — host preparation
Ansible owns everything that happens on a host before workloads run.
Terraform (../terraform/) owns the workloads themselves.
The boundary is deliberate and documented in
06 — Environments.
| Playbook | Target | What it does |
|---|---|---|
drone-provision.yml |
Drone (on the bench, before a mission) | Identity keys, peer trust with forced commands, WireGuard, Compose bundle from the fleet release manifest |
sim-cluster.yml |
Local workstation / CI host | k3d cluster that miniatures the ground segment; shared data volume; simulator image import |
Provision a drone
ansible-playbook -i inventory.example.yml drone-provision.yml
The playbook is idempotent and runs only over the bench network — drones are never provisioned in flight (see 05 — Network & security):
- Identity: generate the drone's ed25519 keypair if absent.
- Peer trust: install every fleet member's public key into
authorized_keys, each pinned to the read-only SQL forced command — the only thing a peer can execute. - WireGuard: render
wg0.confwith the drone's address and peers. - Data plane: lay down the Compose bundle referenced by the fleet release manifest and enable it as a systemd unit.
Create the simulation cluster
ansible-playbook sim-cluster.yml # creates k3d cluster 'swarm-sim'
cd ../terraform/sim-env && terraform init && terraform apply
The cluster mounts a shared host directory as /data on the (single)
node, so drone pods, the exporter, and the explorer see one Parquet lake —
the same contract as the on-board NVMe layout.