Playbook Reference

All playbooks live at the repo root under ansible/.

Playbook	Purpose
start-cluster.yml	Wake ESXi (WOL), power on control-plane + system node VMs, wait for the cluster to come up, uncordon nodes
stop-cluster.yml	Drain nodes, gracefully shut down VMs, then gracefully shut down the ESXi host itself
supervisor-cluster-shutdown.yml	Shutdown sequence specific to the Tanzu Supervisor stack — discovers the dynamic supervisor-API VIP (decryptK8Pwd.py) rather than assuming a fixed address, since WCP can reassign it across cycles
backup-playbook.yml	Nightly config backup: NAS, UniFi controller, TrueNAS-DR config, pfSense config — see pipelines/backup.yml
ssl-renew-playbook.yml	Certificate renewal automation, paired with pfSense's ACME setup — see ACME Certificates
recording_cleanup.yml	Prunes old camera/NVR recordings
clean-docker-images.yml	Docker image/layer cleanup on hosts running containers
start-stop-esxi.yml	Lower-level ESXi host power operations, used outside the full cluster start/stop flow
vcsa-esxi-simple-ssh.yml	Ad-hoc connectivity check against vCenter/ESXi over SSH

Why start-cluster.yml/stop-cluster.yml and not a raw reboot

These playbooks exist specifically to make the DHCP-lease-preserving path (drain → guest shutdown → ESXi host shutdown → WOL → power-on) the path of least resistance. Kea's lease table for a MAC that goes through this cycle quickly is very likely to still be valid when the host comes back, which is why routine use of these playbooks had never surfaced the IP-pinning fragility documented in Kubernetes Troubleshooting — until a manual reboot, done outside this flow and overlapping with unrelated lease churn elsewhere on the network, finally did.