feat: add prevent downgrades check in k3s ansible

Signed-off-by: Devin Buhl <devin@buhl.casa>

README.md

@@ -14,7 +14,7 @@ The features included will depend on the type of configuration you want to use.
 
 2. "**Flux cluster**" - Add-on to the "**Bare cluster**" to deploy an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as GitOps provider and [sops](https://github.com/getsops/sops) to manage secrets.
 
-   - **Apps included:** [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader) [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs) in [Local PV / Hostpath](https://openebs.io/docs/concepts/localpv) mode.
+   - **Apps included:** [flux](https://github.com/fluxcd/flux2), [cert-manager](https://github.com/cert-manager/cert-manager), [spegel](https://github.com/XenitAB/spegel), [reloader](https://github.com/stakater/Reloader), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), and [openebs](https://github.com/openebs/openebs) in [Local PV / Hostpath](https://openebs.io/docs/concepts/localpv) mode.
 
 3. "**Flux cluster with Cloudflare**" - Add-on to the "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster.
 

bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2

@@ -22,6 +22,10 @@
         k3s_server_manifests_templates: []
         k3s_server_manifests_urls: []
 
+    - name: Prevent downgrades
+      when: k3s_installed.stat.exists
+      ansible.builtin.include_tasks: tasks/version-check.yaml
+
     - name: Install Kubernetes
       ansible.builtin.include_role:
         name: xanmanning.k3s

bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2

@@ -1,5 +1,4 @@
 ---
-# https://github.com/k3s-io/k3s/issues/1971
 - name: Cruft
   block:
     - name: Cruft | Get list of custom manifests

bootstrap/templates/ansible/playbooks/tasks/version-check.yaml.j2

@@ -0,0 +1,18 @@
+---
+- name: Version Check
+  block:
+    - name: Get deployed k3s version
+      ansible.builtin.command: k3s --version
+      register: k3s_version
+      changed_when: false
+      failed_when: false
+
+    - name: Extract k3s version
+      ansible.builtin.set_fact:
+        current_k3s_version: "{{ k3s_version.stdout | regex_replace('(?im)k3s version (?P<version>[a-z0-9\\.\\+]+).*\n.*', '\\g<version>') }}"
+
+    - name: Check if upgrades are allowed
+      ansible.builtin.assert:
+        that:
+          - "k3s_release_version is version(current_k3s_version, '>=')"
+        fail_msg: "Unable to upgrade k3s because the deployed version is higher than the one specified in the configuration"