redeploy authentic policies as code.

ansible/playbooks/roles/talosctl/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/talosctl/defaults/main.yml
+# DESCRIPTION: Default variables for talosctl installation.
+# ------------------------------------------------------------------------------
+
+# Pin to a specific version for reproducibility.
+# Update this when upgrading the fastpass cluster.
+talosctl_version: "v1.12.4"
+
+# Architecture of the target host (amd64 or arm64)
+talosctl_arch: "amd64"
+
+# Where to install the binary
+talosctl_install_dir: "/usr/local/bin"

ansible/playbooks/roles/talosctl/main.yml

@@ -0,0 +1,51 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/talosctl/tasks/main.yml
+# DESCRIPTION: Install talosctl binary from GitHub releases.
+#              Downloads a pinned version, installs to /usr/local/bin,
+#              and verifies the installation.
+# ------------------------------------------------------------------------------
+
+- name: Check if talosctl is already installed
+  stat:
+    path: "{{ talosctl_install_dir }}/talosctl"
+  register: talosctl_binary
+
+- name: Get installed talosctl version
+  command: "{{ talosctl_install_dir }}/talosctl version --client --short"
+  register: talosctl_installed_version
+  changed_when: false
+  failed_when: false
+  when: talosctl_binary.stat.exists
+
+- name: Install talosctl
+  when: >
+    not talosctl_binary.stat.exists or
+    talosctl_version not in (talosctl_installed_version.stdout | default(''))
+  block:
+    - name: Download talosctl {{ talosctl_version }}
+      get_url:
+        url: "https://github.com/siderolabs/talos/releases/download/{{ talosctl_version }}/talosctl-linux-{{ talosctl_arch }}"
+        dest: "/tmp/talosctl"
+        mode: "0755"
+
+    - name: Install talosctl to {{ talosctl_install_dir }}
+      copy:
+        src: "/tmp/talosctl"
+        dest: "{{ talosctl_install_dir }}/talosctl"
+        mode: "0755"
+        remote_src: true
+
+    - name: Clean up downloaded binary
+      file:
+        path: "/tmp/talosctl"
+        state: absent
+
+- name: Verify talosctl installation
+  command: "{{ talosctl_install_dir }}/talosctl version --client --short"
+  register: talosctl_verify
+  changed_when: false
+
+- name: Display installed talosctl version
+  debug:
+    msg: "talosctl installed: {{ talosctl_verify.stdout }}"

ansible/playbooks/roles/talosctl/meta/main.yml

@@ -0,0 +1,17 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/talosctl/meta/main.yml
+# ------------------------------------------------------------------------------
+
+galaxy_info:
+  author: rblundon
+  description: Install talosctl CLI for managing TalosOS clusters
+  license: MIT
+  min_ansible_version: "2.14"
+  platforms:
+    - name: Ubuntu
+      versions:
+        - noble
+
+dependencies:
+  - role: common