[znerol2]

Summary

On a 1:1-NAT node, the inventory's k3s_node_ip is the public address (the SSH target). Playbook 300 rebinds it to the node's local address through tasks/resolve-k3s-node-ip.yml. Playbooks 321 and 694 didn't, so running either on its own wrote the public address into the CoreDNS custom zone, the node's /etc/hosts and the born inventory. In-cluster traffic to the app hosts then left the node and came back through the provider's NAT.

Changes

• 321 and 694 gather network facts and import the same resolver, so the result no longer depends on which plays ran earlier in the run. In 321 this happens only in the local-CA lane.
• Resolver records the declared address in k3s_node_nat_declared_ip when it rebinds. It doesn't touch non-NAT nodes.
• Born inventory uses that fact as public_ip on NAT nodes only. Other nodes keep the default-route address.
• Contract change, on purpose: a standalone 694 run used to skip fact gathering, so it fell back to ansible_host for public_ip. It now records what a full bootstrap run records. The play header says so, and a test pins it.
• docs/repo-strategy.md explains how the resolver treats NAT nodes.

Tests

• New tests/test_local_ca_node_address.py (8 tests, wired into CI): a fresh standalone run with NAT-shaped facts from the plays' own setup task, a repeat resolver call after 300 with unset, equal and different preset external addresses, non-NAT nodes, and a check that each play's real setup arguments return the facts the resolver needs.
• tests/test-k3s-nat-bind-ip.yml asserts the new fact.
• Several of the new tests fail on origin/main. Each of these mutations fails a test: removing the resolver import, removing either play's setup task, adding a filter: to setup, using k3s_node_external_ip as public_ip, and overwriting the declared address on a repeat call.

Live check

On a 1:1-NAT sandbox node, 321 ran on its own from this branch with no address override: failed=0, changed=0. The resolver rebound the address, and all app hosts in the zone and in /etc/hosts stayed on the node's internal address.

Closes dmfdeploy/dmfdeploy#901

[lkirc]

Static review of current head 646d9d6: the standalone NAT address resolution and born-inventory handling are correct, and the added test runs under the existing required ansible check. No blocking findings.