# Manual Fedora 44 checklist

Use the values in `inventory.yml` as the source of truth. The manual result must
match the Ansible result: one server named `node1`, one agent named `node2`, the
same pinned k3s version, and both nodes reporting Ready.

1. Install Fedora Server 44 on both hosts, apply system updates, assign stable
   addresses, and confirm SSH access with sudo privileges.
2. Install `curl`, `firewalld`, and `policycoreutils-python-utils` on both hosts.
3. Enable firewalld. Trust the configured pod and service CIDRs, then allow
   `8472/udp` and `10250/tcp` between the two nodes. Allow `6443/tcp` to node 1
   from node 2 and authorized operator networks.
4. Generate a cluster token in a secret manager. Never place it in shell
   history, an inventory file, or this repository.
5. Download the official installer from `https://get.k3s.io`. On node 1, install
   the pinned version in server mode with its stable node IP.
6. On node 2, run the same pinned installer in agent mode with node 1's
   `https://ADDRESS:6443` URL and the runtime cluster token.
7. Enable and start `k3s.service` on node 1 and `k3s-agent.service` on node 2.
8. On node 1, run `k3s kubectl get nodes -o wide` and verify both nodes are
   Ready before installing platform components.

Prefer the playbook for the actual command details. This checklist deliberately
does not encourage copying a cluster token into an interactive command line.
