8ed427a7e4
Goal: re-clone the worker template, boot, and have it appear as `kubectl get nodes …Ready` with no manual steps. Adds `scripts/provision-k8s-worker NAME VMID IP` and rebuilds the cloud-init pipeline that was failing five distinct ways on a clean boot. Bugs fixed (all hit during the k8s-node5 + k8s-node6 builds today): 1. `indent(6, containerd_config_update_command)` indented the bodies of `cat >> /etc/containerd/config.toml <<'CONTAINERD_GC'` heredocs, so [plugins.*] TOML sections landed in /etc/containerd/config.toml at col 6 — containerd refused to parse them. Source is now a normal .sh file (`modules/create-template-vm/k8s-node-containerd-setup.sh`) base64-embedded into `write_files`; YAML whitespace never touches the heredoc bodies. 2. The same script tried to `cat >> /etc/containerd/config.toml` `[plugins."io.containerd.gc.v1.scheduler"]` etc., which containerd v2.2.4's `config default` ALREADY emits. Result: `toml: table … already exists`. Patched with sed-in-place overrides instead. 3. Kubelet tuning (sed against /var/lib/kubelet/config.yaml) ran from the containerd setup script — BEFORE `kubeadm join` writes that file. Sed aborted with "No such file or directory", `set -e` killed the script, post-script cloud-init steps kept going (cloud-init doesn't stop on runcmd failure). Split into a dedicated `k8s-node-post-join-tune.sh` invoked AFTER kubeadm join. 4. cloud_init.yaml fallocate'd a 4G swapfile and `swapon`'d it BEFORE kubeadm join. kubelet defaults to failSwapOn=true → exited 1 immediately. Replaced the swap setup with `swapoff -a` (node4 already runs this way and the cluster is fine). 5. Without `hostname:` in the shared user-data snippet, Proxmox's auto-generated meta-data does NOT include local-hostname when `cicustom user=…` is set — so cloud-init falls back to the cloud image's default `ubuntu` and `kubeadm join` registers the wrong node name. `provision-k8s-worker` now writes a per-node `<NAME>-meta.yaml` snippet and passes both via `cicustom user=…,meta=…`. Other improvements rolled in while fixing the above: - `ssh_public_key` read from Vault (`secret/viktor.ssh_public_key`, added today) instead of `var.ssh_public_key`. The last `terragrunt apply` was run with that var empty, leaving the snippet's `ssh_authorized_keys` with a single blank entry; the wizard user was effectively locked out of every fresh node. - `cloud_init.yaml` adds `/etc/systemd/resolved.conf.d/global-dns.conf` with `DNS=8.8.8.8 1.1.1.1, FallbackDNS=10.0.20.201`. Without it, systemd-resolved only consulted Technitium (link-level), which returns NXDOMAIN for `forgejo.viktorbarzin.me` — kubelet pulls from the Forgejo registry then failed DNS until I patched it manually on node5. - k8s apt repo bumped v1.32 → v1.34 (matches cluster). - The containerd setup script now creates hosts.toml for forgejo, quay, registry.k8s.io in addition to docker.io + ghcr.io. node3/4 had these added by hand post-bootstrap; now they're baked in. - `config_path` sed matches both `""` (containerd v1) and `''` (containerd v2.x). Without the v2 match, the certs.d mirror dir was silently ignored. - `proxmox-csi` node map adds k8s-node5 + k8s-node6 entries so CSI topology labels (region/zone, max-volume-attachments=28) apply on next `tg apply`. - `stacks/infra/main.tf` shed the 160-line inline containerd setup heredoc — that whole thing now lives in the module as a .sh file. Known unsolved gaps (deferred): - iscsid restart hangs ~90s on first boot before SIGKILL releases it (systemd-resolved restart kicks iscsid via dependency). Adds wall- clock time but doesn't block the join. - `provision-k8s-worker` doesn't run `tg apply` on `proxmox-csi` afterward, so the CSI topology labels need a manual apply after the node joins. Solving cleanly needs the CSI map to derive from `kubectl get nodes` instead of a static local — separate work. - `var.containerd_config_update_command` is now ignored when is_k8s_template=true (replaced by the bundled .sh file). Variable kept with a deprecation note to avoid breaking other call sites. E2E proof: k8s-node6 (VMID 206) boots hands-off from `provision-k8s-worker k8s-node6 206 10.0.20.106` and appears as `kubectl get nodes …Ready` ~7 min later (most of which is the apt package_upgrade — separate optimization). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
78 lines
3 KiB
Bash
Executable file
78 lines
3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# Runs AFTER `kubeadm join` has written /var/lib/kubelet/config.yaml.
|
|
# Patches kubelet config in place (parallel image pulls, eviction
|
|
# thresholds, priority-based shutdown grace, container log rotation)
|
|
# and (on master) tightens controller-manager / apiserver flags.
|
|
#
|
|
# Embedded into the cloud-init snippet base64-encoded by main.tf so
|
|
# YAML whitespace doesn't touch the heredoc bodies inside.
|
|
set -euo pipefail
|
|
|
|
if [ ! -f /var/lib/kubelet/config.yaml ]; then
|
|
echo "post-join-tune: /var/lib/kubelet/config.yaml not found — was kubeadm join run?" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Parallel image pulls.
|
|
sed -i '/serializeImagePulls:/d' /var/lib/kubelet/config.yaml
|
|
sed -i '/maxParallelImagePulls:/d' /var/lib/kubelet/config.yaml
|
|
printf 'serializeImagePulls: false\nmaxParallelImagePulls: 50\n' >> /var/lib/kubelet/config.yaml
|
|
|
|
# Memory / disk eviction. Aggressive disk thresholds (15%/20%)
|
|
# prevent the 2026-03-13 containerd image-store corruption that took
|
|
# down k8s-node2.
|
|
sed -i '/systemReserved:/d; /kubeReserved:/d; /evictionHard:/,/^[^ ]/{ /evictionHard:/d; /^ /d }; /evictionSoft:/,/^[^ ]/{ /evictionSoft:/d; /^ /d }; /evictionSoftGracePeriod:/,/^[^ ]/{ /evictionSoftGracePeriod:/d; /^ /d }' /var/lib/kubelet/config.yaml
|
|
|
|
cat >> /var/lib/kubelet/config.yaml <<'KUBELET_PATCH'
|
|
systemReserved:
|
|
memory: "512Mi"
|
|
cpu: "200m"
|
|
kubeReserved:
|
|
memory: "512Mi"
|
|
cpu: "200m"
|
|
evictionHard:
|
|
memory.available: "500Mi"
|
|
nodefs.available: "15%"
|
|
imagefs.available: "20%"
|
|
evictionSoft:
|
|
memory.available: "1Gi"
|
|
nodefs.available: "20%"
|
|
imagefs.available: "25%"
|
|
evictionSoftGracePeriod:
|
|
memory.available: "30s"
|
|
nodefs.available: "60s"
|
|
imagefs.available: "30s"
|
|
memorySwap:
|
|
swapBehavior: "LimitedSwap"
|
|
KUBELET_PATCH
|
|
|
|
# Container log rotation + priority-based shutdown grace.
|
|
sed -i '/^shutdownGracePeriod:/d; /^shutdownGracePeriodCriticalPods:/d' /var/lib/kubelet/config.yaml
|
|
python3 - <<'KUBELET_FINAL'
|
|
import yaml
|
|
with open('/var/lib/kubelet/config.yaml') as f:
|
|
cfg = yaml.safe_load(f)
|
|
cfg.pop('shutdownGracePeriod', None)
|
|
cfg.pop('shutdownGracePeriodCriticalPods', None)
|
|
cfg.pop('shutdownGracePeriodByPodPriority', None)
|
|
cfg['containerLogMaxSize'] = '10Mi'
|
|
cfg['containerLogMaxFiles'] = 3
|
|
cfg['shutdownGracePeriodByPodPriority'] = [
|
|
{'priority': 0, 'shutdownGracePeriodSeconds': 20},
|
|
{'priority': 200000, 'shutdownGracePeriodSeconds': 20},
|
|
{'priority': 400000, 'shutdownGracePeriodSeconds': 30},
|
|
{'priority': 600000, 'shutdownGracePeriodSeconds': 30},
|
|
{'priority': 800000, 'shutdownGracePeriodSeconds': 90},
|
|
{'priority': 1000000, 'shutdownGracePeriodSeconds': 30},
|
|
{'priority': 1200000, 'shutdownGracePeriodSeconds': 30},
|
|
{'priority': 2000000000, 'shutdownGracePeriodSeconds': 30},
|
|
{'priority': 2000001000, 'shutdownGracePeriodSeconds': 30},
|
|
]
|
|
with open('/var/lib/kubelet/config.yaml', 'w') as f:
|
|
yaml.dump(cfg, f, default_flow_style=False)
|
|
KUBELET_FINAL
|
|
|
|
# Reload kubelet to pick up new config (it's already started by the
|
|
# preceding cloud-init runcmd line — restart, not start).
|
|
systemctl restart kubelet
|