Everything an operator runs goes through go-task . The root
Taskfile.yaml is only a set of includes; the real definitions are one file per namespace
under .taskfiles/.
task --list
Arguments come after --. A task documented as -- <x> requires one; [-- <x>] takes an
optional one.
Task Does
ops:setupEverything below, plus tf:init. Run this once on a new workstation ops:depsInstall the toolchain. Needs dnf and uv ops:collectionsansible-galaxy collection install -r requirements.ymlops:hookspre-commit install
Task Does
ans:setup [-- <host>]First contact and hardening. Re-runnable ans:k0sConverge the cluster and bootstrap Flux ans:pingansible all -m pingans:lintansible-lint
Task Does
bao:statusSeal and init status bao:policy-syncNamespace, mount, auth and policy bootstrap. Idempotent bao:kv -- <args>Run bao kv in-cluster. Root token is piped over stdin, never argv
task bao:kv -- get -namespace=node-kenaz secret/actual
task bao:kv -- put -namespace=infra secret/foo key=value
Task Does
fx:getKustomizations and their sync status fx:sourcesGitRepository sources fx:hrHelmReleases fx:failingOnly Kustomizations and HelmReleases that aren’t Ready fx:reconcile [-- <name>]Force-reconcile one, or all of them, --with-source fx:redeploy -- <name>Force a HelmRelease to reinstall even if its chart is unchanged fx:logs [-- <controller>]Tail a controller, default kustomize-controller
Task Does
k0s:statusOne screen: nodes, unhealthy pods, Flux sync state k0s:nodeskubectl get nodes -o widek0s:pods [-- <ns>]List pods k0s:failingOnly pods not Running with every container ready. Completed Jobs excluded k0s:events [-- <ns>]Recent events, oldest first k0s:warnings [-- <ns>]Warning events only k0s:logs -- <ns>/<name>Follow logs. <name> may be deploy/x, job/x, or a pod k0s:previous -- <ns>/<pod>A crashed pod’s logs from before its last restart k0s:describe -- <ns>/<pod>Describe a pod, with its events k0s:restart -- <ns>/<deploy>Roll a Deployment and wait for it k0s:jobs [-- <ns>]Jobs and CronJobs k0s:jobs-clean [-- <ns>]Delete finished Jobs. Running ones are left alone k0s:topReal CPU/memory per node, and the 15 hungriest pods k0s:ingressIngresses across all namespaces k0s:certsCertificates and pending CertificateRequests k0s:applyRe-converge with k0sctl and re-bootstrap Flux
Every k0s:* and fx:* task points KUBECONFIG at ansible/.generated/kubeconfig itself —
you do not need it in your environment.
Task Does
tf:init [-- <module>]All modules if no argument. No secrets needed tf:plan -- <module>Plan, with secrets.env resolved through pass-cli tf:apply -- <module>Apply tf:validate -- <module>tofu validate
Task Does
docs:buildBuild into docs/book/, which is gitignored docs:serveServe with live reload and open a browser