Bringing srvk8sdev up

srvk8sdev is the single-node dev cluster: microk8s (k8s_dev) with a co-located microceph (ceph_dev). It is off by default, on_boot = false in Ansible terraform/prd/vms.tf since 2026-10-03, and Terraform ignores whether it runs. Nothing depends on it. Besides you, only SecretRotator's nightly run (05:30) starts it, for a due plan with a step on the dev cluster, and shuts it down again after if it started it (openbao.md § 5); such a boot does none of the catch-up below. Every weekly job skips a dev host it cannot reach: IaC/Scheduled Certs (Friday) and IaC/Scheduled Update (Sunday) go UNSTABLE on their dev stage, and IaC/Apply converges it last in a stage that can only go UNSTABLE. So each time it comes up it owes what it missed.

Ansible commands run from the checkout's ansible/; in a KubeCoder environment put cexec iac after the cd.

Before #

1. What waits for itYouTrack #Unresolved srvk8sdev and #Unresolved "dev cluster"
2. Start itssh root@pve qm start 919
3. Reachablecd ansible && poetry run ansible k8s_dev -m ping

Catch up #

Every time, in this order: SSH first, because every playbook rides on it.

1. SSH host certificate. The ping decides:
   • pong: cd ansible && poetry run ansible-playbook playbooks/renew-host-certs.yml --limit k8s_dev (a no-op outside the 14-day window).
   • UNREACHABLE with Certificate invalid: expired: it lapsed while off. Re-issue it with playbooks/reissue-host-cert.yml -e reissue_target=srvk8sdev. srvk8sdev is built from scratch, so the playbook pins its key from terraform output.
2. TLS leaf for kubernetes-api-dev.home :: cd ansible && poetry run ansible-playbook playbooks/renew-internal-tls.yml --limit k8s_dev — a lapsed leaf needs nothing more (internal-tls-expiry.md § Notes)
3. OS and microk8s :: cd ansible && poetry run ansible-playbook playbooks/update-k8s.yml --limit srvk8sdev (k8s-upgrade.md § srvk8sdev). Single node, so no drain: the dev cluster is down while it reboots.
4. If IaC/Apply ran while it was off, its dev stage was skipped. By hand: cd ansible && poetry run ansible-playbook playbooks/site-k8s.yml --limit k8s_dev --skip-tags os_update, then playbooks/site-ceph.yml --skip-tags os_update.

Then #

Do what you came for. Runbooks that need it: s3-mirror.md § Restore drill, k8s-rebuild.md § srvk8sdev. From a KubeCoder environment it answers on SSH, 16443 and RGW's port 80, and the default kubeconfig reads it with kubectl --context dev (live-infra-access.md).

After #

1. Shut it downssh root@pve qm shutdown 919
2. Leave on_boot = false alone. Next Sunday's IaC/Scheduled Update goes UNSTABLE on its dev stage again: expected, leave it.