From fdff319d4f6741c291f2ba6c6c46aba8f2788806 Mon Sep 17 00:00:00 2001
From: Devin Buhl <onedr0p@users.noreply.github.com>
Date: Wed, 22 Nov 2023 20:15:04 -0500
Subject: [PATCH] feat(k3s): enable encryption at rest and stargz snapshotter

---
 .../templates/ansible/inventory/group_vars/master/main.yaml.j2  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
index 0550793e..f472ab2d 100644
--- a/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
+++ b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
@@ -24,6 +24,8 @@ k3s_server:
   disable-network-policy: true
   disable-cloud-controller: true
   disable-kube-proxy: true            # Cilium uses eBPF
+  secrets-encryption: true
+  snapshotter: stargz
   write-kubeconfig-mode: "644"
 {% if bootstrap_ipv6_enabled | default(false) %}
   cluster-cidr: "{% raw %}{{ cluster_cidr }},{{ cluster_cidr_v6 }}{% endraw %}"