67d1ce453c
The kured sentinel gate DaemonSet requires /sentinel to exist on all nodes. Without it, kured pods get stuck in ContainerCreating with hostPath mount failure. Previously created manually; now provisioned automatically for new nodes.
86 lines
2.2 KiB
YAML
86 lines
2.2 KiB
YAML
#cloud-config
|
|
hostname: terraform-vm
|
|
users:
|
|
- name: wizard
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
ssh_authorized_keys:
|
|
- ${authorized_ssh_key}
|
|
passwd: ${passwd}
|
|
lock_passwd: false # enable passwd login
|
|
shell: /bin/bash
|
|
package_update: true
|
|
package_upgrade: true
|
|
packages:
|
|
- htop
|
|
- vim
|
|
- curl
|
|
- jq
|
|
- tcpdump
|
|
- tree
|
|
- tmux
|
|
- wget
|
|
- net-tools
|
|
- zsh
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- gpg
|
|
- isc-dhcp-client
|
|
- cloud-guest-utils # to enable resizing of disk via growpart
|
|
- qemu-guest-agent
|
|
- nginx
|
|
# docker
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
%{if is_k8s_template}
|
|
# kubernetes
|
|
- kubeadm
|
|
- kubelet
|
|
# iSCSI client for CSI-backed database storage
|
|
- open-iscsi
|
|
%{endif}
|
|
|
|
apt:
|
|
sources:
|
|
%{if is_k8s_template}
|
|
kubernetes:
|
|
source: "deb https://pkgs.k8s.io/core:/stable:/v1.32/deb/ /"
|
|
keyid: "DE15B14486CD377B9E876E1A234654DA9A296436"
|
|
filename: kubernetes.list
|
|
%{endif}
|
|
docker:
|
|
source: "deb https://download.docker.com/linux/ubuntu noble stable"
|
|
keyid: "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
|
|
filename: docker.list
|
|
|
|
runcmd:
|
|
# Enable persistent journald logging for crash forensics
|
|
- mkdir -p /var/log/journal
|
|
- sed -i 's/#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf
|
|
- systemctl restart systemd-journald
|
|
%{if is_k8s_template}
|
|
- apt-mark hold kubelet kubeadm kubectl
|
|
- systemctl stop kubelet
|
|
- containerd config default | sudo tee /etc/containerd/config.toml
|
|
- ${containerd_config_update_command}
|
|
- systemctl restart containerd
|
|
- systemctl enable --now iscsid
|
|
# Create /sentinel directory for kured reboot gating (sentinel gate DaemonSet)
|
|
- mkdir -p /sentinel
|
|
# Create 4Gi swap file for worker node memory pressure relief (NOT for master — etcd is latency-critical)
|
|
- fallocate -l 4G /swapfile
|
|
- chmod 600 /swapfile
|
|
- mkswap /swapfile
|
|
- swapon /swapfile
|
|
- echo '/swapfile none swap sw 0 0' >> /etc/fstab
|
|
- sysctl -w vm.swappiness=10
|
|
- echo 'vm.swappiness=10' >> /etc/sysctl.d/99-swap.conf
|
|
- ${k8s_join_command}
|
|
- systemctl enable kubelet
|
|
- systemctl start kubelet
|
|
%{ endif }
|
|
%{ for provision_cmd in provision_cmds ~}
|
|
- ${provision_cmd}
|
|
%{ endfor ~}
|