K0s Cluster

READ-ONLY. Render the deterministic k0s.yaml for the given cluster inputs and store it as a file. Manifest stacks are not part of k0s.yaml (k0s reads them from its manifest directory), so their planned layout is returned separately.

DESTRUCTIVE. Fetch the pinned k0s binary, verify its SHA-256, upload it with k0s.yaml and install the role, then start the service. Idempotent: a re-run adopts the running service and never installs a second node. Refuses to change an installed role unless confirm_role_change names the host; the replacement is downloaded and verified before the old role is torn down.

DESTRUCTIVE. Upgrade the installed k0s binary to the pinned version, verifying the new binary before anything is stopped; a lower version and a Kubernetes minor skip are refused, and the same version is a no-op. On any failure after the stop the previous binary is restored and the unit restarted.

READ-ONLY. Poll until a node reports Ready and the kube-system pods are running, up to ready_timeout_s. Returns ready false after the timeout; a connection, authentication or host-key failure is raised, never reported as not-ready. Stores readiness evidence.

READ-ONLY. Fetch the admin kubeconfig and keep it as a sensitive value, or write it to a vault key named by store_in_vault. The kubeconfig text never appears in the return value, logs or --json output; only its SHA-256, server URL and the vault key are returned.

DESTRUCTIVE. Place a named manifest stack under the k0s manifest directory, uploading only changed files and removing files no longer declared. Idempotent: re-applying identical files changes nothing. Returns the stack, its files and whether anything changed.

DESTRUCTIVE. Reconcile the declared Helm extensions in k0s.yaml, restarting the controller only when the file changes, then wait until each release is present. Idempotent on an unchanged file. Fails if the controller does not restart healthy or a chart does not reconcile in time.

READ-ONLY. Read the k0s version, node status, config digest, manifest stacks and Helm releases from the host and store them. Reports whether a kubeconfig has been recorded.

READ-ONLY. Compare the recorded install with the live host and report drift, refreshing the stored status. Returns whether the record is in sync and each difference.

DESTRUCTIVE. Stop and uninstall k0s on the host and remove its configuration. Re-running on a host with no k0s unit is a clean no-op.