Upgrade K3s and infrastructure with selective DNS relay

ansible/roles/common/tasks/control-plane-relay.yml

@@ -0,0 +1,43 @@
+- name: Ensure nftables is available on control-plane nodes
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+
+- name: Validate and deploy the selective relay rules
+  ansible.builtin.template:
+    src: control-plane-relay.nft.j2
+    dest: /etc/k3s-control-plane-relay.nft
+    mode: "0644"
+    validate: /usr/sbin/nft --check --file %s
+  register: control_plane_relay_rules
+
+- name: Configure public DNS names for selective relay
+  ansible.builtin.copy:
+    content: "{{ tailscale_control_plane_relay_peers | to_nice_json }}\n"
+    dest: /etc/k3s-control-plane-relay.json
+    mode: "0644"
+  register: control_plane_relay_peers
+
+- name: Install the selective relay resolver and systemd units
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - { src: k3s-control-plane-relay.py, dest: /usr/local/sbin/k3s-control-plane-relay, mode: "0755" }
+    - { src: k3s-control-plane-relay.service, dest: /etc/systemd/system/k3s-control-plane-relay.service, mode: "0644" }
+    - { src: k3s-control-plane-relay.timer, dest: /etc/systemd/system/k3s-control-plane-relay.timer, mode: "0644" }
+  register: control_plane_relay_files
+
+- name: Persist and apply selective relay
+  ansible.builtin.systemd:
+    name: k3s-control-plane-relay
+    enabled: true
+    daemon_reload: "{{ control_plane_relay_files.changed }}"
+    state: "{{ 'restarted' if control_plane_relay_rules.changed or control_plane_relay_peers.changed or control_plane_relay_files.changed else omit }}"
+
+- name: Enable periodic DNS refresh
+  ansible.builtin.systemd:
+    name: k3s-control-plane-relay.timer
+    enabled: true
+    state: started