k3s with secrets encryption

hosts.yml

@@ -38,6 +38,9 @@ all:
       lbu_media: mmcblk0p2
       lbu_backupdir: /media/mmcblk0p2
 
+      k3s_args:
+        - --secrets-encryption
+
       dmcrypt_targets:
         - name: "WDC WDS400T1R0A"
           target: "disk0"

roles/k3s/defaults/main.yml

@@ -0,0 +1 @@
+k3s_args: []

roles/k3s/tasks/main.yml

@@ -41,9 +41,9 @@
     access_time: preserve
 
 - name: copy service file
-  copy:
-    src: init.d/k3s
-    dest: /etc/init.d
+  template:
+    src: init.d/k3s.j2
+    dest: /etc/init.d/k3s
     mode: '0755'
   when: ansible_distribution == "Alpine"
 

roles/k3s/templates/init.d/k3s.j2

@@ -13,6 +13,9 @@ supervisor=supervise-daemon
 name=k3s
 command="/usr/local/bin/k3s"
 command_args="server \
+    {% for arg in k3s_args %}
+        {{ arg }} \
+    {% endfor %}
     >>/var/log/k3s.log 2>&1"
 
 output_log=/var/log/k3s.log