Switch to cloud-init for host initialization
This commit is contained in:
Marco Nenciarini
parent
c309a1b290
commit
5f7d47783b
@ -145,9 +145,9 @@ locals {
|
||||
"[ -e /etc/rancher/k3s/k3s.yaml ] && exit 0",
|
||||
]
|
||||
|
||||
install_k3s_server = concat(local.common_commands_install_k3s, ["curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_SELINUX_RPM=true INSTALL_K3S_SKIP_START=true INSTALL_K3S_CHANNEL=${var.initial_k3s_channel} INSTALL_K3S_EXEC=server sh -"])
|
||||
install_k3s_server = concat(local.common_commands_install_k3s, ["curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true INSTALL_K3S_CHANNEL=${var.initial_k3s_channel} INSTALL_K3S_EXEC=server sh -"])
|
||||
|
||||
install_k3s_agent = concat(local.common_commands_install_k3s, ["curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_SELINUX_RPM=true INSTALL_K3S_SKIP_START=true INSTALL_K3S_CHANNEL=${var.initial_k3s_channel} INSTALL_K3S_EXEC=agent sh -"])
|
||||
install_k3s_agent = concat(local.common_commands_install_k3s, ["curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true INSTALL_K3S_CHANNEL=${var.initial_k3s_channel} INSTALL_K3S_EXEC=agent sh -"])
|
||||
|
||||
agent_nodepools = merge([
|
||||
for nodepool_name, nodepool_obj in var.agent_nodepools : {
|
||||
|
||||
@ -15,60 +15,7 @@ locals {
|
||||
"set -ex",
|
||||
"apt-get update",
|
||||
"apt-get install -y aria2",
|
||||
"aria2c --follow-metalink=mem https://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-kvm-and-xen.qcow2.meta4",
|
||||
"aria2c --follow-metalink=mem https://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-OpenStack-Cloud.qcow2.meta4",
|
||||
"qemu-img convert -p -f qcow2 -O host_device $(ls -a | grep -ie '^opensuse.*microos.*qcow2$') /dev/sda",
|
||||
"sgdisk -e /dev/sda",
|
||||
"parted -s /dev/sda resizepart 4 99%",
|
||||
"parted -s /dev/sda mkpart primary ext2 99% 100%",
|
||||
"partprobe /dev/sda && udevadm settle && fdisk -l /dev/sda",
|
||||
"mount /dev/sda4 /mnt/ && btrfs filesystem resize max /mnt && umount /mnt",
|
||||
"mke2fs -L ignition /dev/sda5",
|
||||
"mount /dev/sda5 /mnt",
|
||||
"mkdir /mnt/ignition",
|
||||
"cp /root/config.ign /mnt/ignition/config.ign",
|
||||
"mkdir /mnt/combustion",
|
||||
"cp /root/script /mnt/combustion/script",
|
||||
"umount /mnt"
|
||||
]
|
||||
|
||||
ignition_config = jsonencode({
|
||||
ignition = {
|
||||
version = "3.0.0"
|
||||
}
|
||||
passwd = {
|
||||
users = [{
|
||||
name = "root"
|
||||
sshAuthorizedKeys = concat([local.ssh_public_key], var.additional_public_keys)
|
||||
}]
|
||||
}
|
||||
storage = {
|
||||
files = [
|
||||
{
|
||||
path = "/etc/sysconfig/network/ifcfg-eth1"
|
||||
mode = 420
|
||||
overwrite = true
|
||||
contents = { "source" = "data:,BOOTPROTO%3D%27dhcp%27%0ASTARTMODE%3D%27auto%27" }
|
||||
},
|
||||
{
|
||||
path = "/etc/ssh/sshd_config.d/kube-hetzner.conf"
|
||||
mode = 420
|
||||
overwrite = true
|
||||
contents = { "source" = "data:,PasswordAuthentication%20no%0AX11Forwarding%20no%0AMaxAuthTries%202%0AAllowTcpForwarding%20no%0AAllowAgentForwarding%20no%0AAuthorizedKeysFile%20.ssh%2Fauthorized_keys" }
|
||||
}
|
||||
]
|
||||
}
|
||||
})
|
||||
|
||||
combustion_script = <<EOF
|
||||
#!/bin/bash
|
||||
sed -i 's#NETCONFIG_NIS_SETDOMAINNAME="yes"#NETCONFIG_NIS_SETDOMAINNAME="no"#g' /etc/sysconfig/network/config
|
||||
sed -i 's#WAIT_FOR_INTERFACES="30"#WAIT_FOR_INTERFACES="60"#g' /etc/sysconfig/network/config
|
||||
sed -i 's#CHECK_DUPLICATE_IP="yes"#CHECK_DUPLICATE_IP="no"#g' /etc/sysconfig/network/config
|
||||
# combustion: network
|
||||
rpm --import https://rpm.rancher.io/public.key
|
||||
zypper refresh
|
||||
zypper --gpg-auto-import-keys install -y https://rpm.rancher.io/k3s/stable/common/microos/noarch/k3s-selinux-0.4-1.sle.noarch.rpm
|
||||
udevadm settle || true
|
||||
EOF
|
||||
|
||||
}
|
||||
|
||||
@ -8,10 +8,20 @@ resource "hcloud_server" "server" {
|
||||
ssh_keys = var.ssh_keys
|
||||
firewall_ids = var.firewall_ids
|
||||
placement_group_id = var.placement_group_id
|
||||
|
||||
user_data = data.template_cloudinit_config.config.rendered
|
||||
|
||||
labels = var.labels
|
||||
|
||||
# Prevent destroying the whole cluster if the user changes
|
||||
# any of the attributes that force to recreate the servers.
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
location,
|
||||
ssh_keys,
|
||||
user_data,
|
||||
]
|
||||
}
|
||||
|
||||
connection {
|
||||
user = "root"
|
||||
private_key = local.ssh_private_key
|
||||
@ -19,17 +29,6 @@ resource "hcloud_server" "server" {
|
||||
host = self.ipv4_address
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
content = local.ignition_config
|
||||
destination = "/root/config.ign"
|
||||
}
|
||||
|
||||
# Combustion script file to install k3s-selinux
|
||||
provisioner "file" {
|
||||
content = local.combustion_script
|
||||
destination = "/root/script"
|
||||
}
|
||||
|
||||
# Install MicroOS
|
||||
provisioner "remote-exec" {
|
||||
inline = local.microOS_install_commands
|
||||
@ -57,8 +56,6 @@ resource "hcloud_server" "server" {
|
||||
"set -ex",
|
||||
"rebootmgrctl set-strategy off",
|
||||
"echo 'REBOOT_METHOD=kured' > /etc/transactional-update.conf",
|
||||
# set the hostname
|
||||
"hostnamectl set-hostname ${self.name}"
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -68,3 +65,33 @@ resource "hcloud_server_network" "server" {
|
||||
server_id = hcloud_server.server.id
|
||||
subnet_id = var.ipv4_subnet_id
|
||||
}
|
||||
|
||||
data "template_cloudinit_config" "config" {
|
||||
gzip = true
|
||||
base64_encode = true
|
||||
|
||||
# Main cloud-config configuration file.
|
||||
part {
|
||||
filename = "init.cfg"
|
||||
content_type = "text/cloud-config"
|
||||
content = templatefile(
|
||||
"${path.module}/templates/userdata.yaml.tpl",
|
||||
{
|
||||
hostname = var.name
|
||||
sshAuthorizedKeys = concat([local.ssh_public_key], var.additional_public_keys)
|
||||
}
|
||||
)
|
||||
}
|
||||
|
||||
# Initialization script (runs at every reboot)
|
||||
part {
|
||||
content_type = "text/cloud-boothook"
|
||||
filename = "boothook.sh"
|
||||
content = templatefile(
|
||||
"${path.module}/templates/boothook.sh.tpl",
|
||||
{
|
||||
hostname = var.name
|
||||
}
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
5
modules/host/templates/boothook.sh.tpl
Normal file
5
modules/host/templates/boothook.sh.tpl
Normal file
@ -0,0 +1,5 @@
|
||||
#!/bin/sh
|
||||
#cloud-boothook
|
||||
|
||||
# Fix hostname after reboot
|
||||
hostnamectl hostname "${hostname}"
|
||||
35
modules/host/templates/userdata.yaml.tpl
Normal file
35
modules/host/templates/userdata.yaml.tpl
Normal file
@ -0,0 +1,35 @@
|
||||
#cloud-config
|
||||
write_files:
|
||||
|
||||
# Configure private network
|
||||
- content: |
|
||||
BOOTPROTO='dhcp'
|
||||
STARTMODE='auto'
|
||||
path: /etc/sysconfig/network/ifcfg-eth1
|
||||
|
||||
# Disable ssh password authentication
|
||||
- content: |
|
||||
PasswordAuthentication no
|
||||
X11Forwarding no
|
||||
MaxAuthTries 2
|
||||
AllowTcpForwarding no
|
||||
AllowAgentForwarding no
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
path: /etc/ssh/sshd_config.d/kube-hetzner.conf
|
||||
|
||||
# Add ssh authorized keys
|
||||
ssh_authorized_keys:
|
||||
%{ for key in sshAuthorizedKeys ~}
|
||||
- ${key}
|
||||
%{ endfor ~}
|
||||
|
||||
runcmd:
|
||||
|
||||
# Activate the private network
|
||||
- systemctl reload network
|
||||
|
||||
# Activate ssh configuration
|
||||
- systemctl reload sshd
|
||||
|
||||
# Fix hostname (during first boot)
|
||||
- hostnamectl hostname ${hostname}
|
||||
@ -12,5 +12,9 @@ terraform {
|
||||
source = "tenstad/remote"
|
||||
version = "~> 0.0.23"
|
||||
}
|
||||
template = {
|
||||
source = "hashicorp/template"
|
||||
version = "~> 2.2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user