unkin-agent
3c77895788
A host being PXE-discovered or installed is not in Kubernetes, so vlagent cannot collect its logs and a failed install leaves no record; the installer environment has no internal-CA trust or credentials for the HTTPS log ingest, and bootapi is already the plain-HTTP broker it can reach. - add POST /logs, token-guarded like POST /provisioned, relaying ndjson to vlinsert's jsonline endpoint keyed on serial+phase - stamp observed source IP and resolved NetBox device name into extra_fields - return 202 on a sink failure so logs never block an install - add BOOTAPI_VLINSERT_URL/_TIMEOUT and bootapi_log_relay metrics
88 lines
4.4 KiB
Bash
88 lines
4.4 KiB
Bash
# bootapi configuration (environment variables).
|
|
#
|
|
# bootapi is configured entirely from the environment (12-factor, like encapi).
|
|
# In Kubernetes these come from the Deployment env + a Vault-sourced Secret and
|
|
# a templates ConfigMap/git repo (see docs/deployment.md). Locally:
|
|
# env $(grep -v '^#' config.example.env | xargs) ./bin/bootapi
|
|
|
|
# --- HTTP (boot path is ALWAYS plain HTTP: PXE installers have no CA trust) ---
|
|
BOOTAPI_LISTEN_ADDR=:8000
|
|
# Optional parallel HTTPS listener for clients that DO trust the internal CA.
|
|
# The boot path still works over plain HTTP; do not 301 HTTP->HTTPS (see docs).
|
|
# BOOTAPI_TLS_LISTEN_ADDR=:8443
|
|
# BOOTAPI_TLS_CERT_FILE=/etc/bootapi/tls/tls.crt
|
|
# BOOTAPI_TLS_KEY_FILE=/etc/bootapi/tls/tls.key
|
|
|
|
# --- NetBox (source of truth for host -> boot data) ---
|
|
BOOTAPI_NETBOX_URL=https://netbox.k8s.syd1.au.unkin.net
|
|
# Provide the token inline OR (preferred in k8s) via a Vault-mounted file.
|
|
# NOTE: the token needs WRITE scope on the device pxe_enabled custom field for
|
|
# the /provisioned callback (see docs/security.md).
|
|
BOOTAPI_NETBOX_TOKEN=
|
|
# BOOTAPI_NETBOX_TOKEN_FILE=/var/run/secrets/netbox/api_token
|
|
BOOTAPI_NETBOX_TIMEOUT=5s
|
|
BOOTAPI_NETBOX_INSECURE=false
|
|
|
|
# --- caching (short: a re-provisioned host must pick up changes next boot) ---
|
|
BOOTAPI_CACHE_TTL=30s
|
|
|
|
# --- templates: git-sync (preferred) OR a local override dir OR embedded ---
|
|
# Pull a templates repo every interval (default 3m, like argocd); a parse
|
|
# failure keeps the last-good set. Embedded defaults are the startup fallback.
|
|
BOOTAPI_TEMPLATE_GIT_URL=https://git.unkin.net/unkin/bootapi-templates.git
|
|
BOOTAPI_TEMPLATE_GIT_BRANCH=main
|
|
BOOTAPI_TEMPLATE_GIT_INTERVAL=3m
|
|
# BOOTAPI_TEMPLATE_GIT_TOKEN= # only for a private templates repo
|
|
# BOOTAPI_TEMPLATE_DIR=/etc/bootapi/templates # used only when GIT_URL is unset
|
|
BOOTAPI_DEFAULT_TEMPLATE=almalinux9
|
|
|
|
# --- URLs baked into rendered output ---
|
|
# bootapi's own PLAIN-HTTP base (goes into iPXE inst.ks= and /ks URLs). Must be
|
|
# reachable without CA trust.
|
|
BOOTAPI_BASE_URL=http://bootapi.k8s.syd1.au.unkin.net
|
|
# Base the end-of-kickstart callback posts to; defaults to BOOTAPI_BASE_URL
|
|
# (plain HTTP, works before the internal CA is installed).
|
|
# BOOTAPI_CALLBACK_BASE_URL=http://bootapi.k8s.syd1.au.unkin.net
|
|
# artifactapi remote base the distro catalog builds kernel/initrd URLs from.
|
|
BOOTAPI_ARTIFACT_BASE_URL=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote
|
|
# Legacy fallback OS-tree base, used only if no catalog entry matches. Normally
|
|
# empty (the distro catalog drives boot images).
|
|
# BOOTAPI_BOOT_BASE_URL=
|
|
|
|
# --- end-of-kickstart callback token (guards POST /provisioned) ---
|
|
# Empty disables the callback (pxe_enabled will not auto-clear). Embedded in the
|
|
# rendered kickstart, so treat as a provisioning secret (docs/security.md).
|
|
BOOTAPI_PROVISION_TOKEN=
|
|
# BOOTAPI_PROVISION_TOKEN_FILE=/var/run/secrets/bootapi/provision_token
|
|
|
|
# --- installer log relay (POST /logs -> VictoriaLogs vlinsert) ---
|
|
# A host being discovered or installed is not in k8s (no vlagent) and has no
|
|
# internal-CA trust or credentials for the HTTPS log ingest, so bootapi relays
|
|
# its newline-delimited JSON logs. Guarded by BOOTAPI_PROVISION_TOKEN.
|
|
# An EMPTY value disables the endpoint (it then 503s).
|
|
BOOTAPI_VLINSERT_URL=http://vlinsert-logs.logging.svc.cluster.local:9481
|
|
# Short on purpose: logs are best-effort, an install must not wait on the sink.
|
|
BOOTAPI_VLINSERT_TIMEOUT=5s
|
|
|
|
# --- puppet bootstrap targets (k8s puppetserver; baked into kickstart %post) ---
|
|
BOOTAPI_PUPPET_SERVER=puppet.k8s.syd1.au.unkin.net
|
|
BOOTAPI_PUPPET_CA_SERVER=puppetca.k8s.syd1.au.unkin.net
|
|
# Written to /etc/sysconfig/puppet-initial as PUPPETCA_URL (read by the
|
|
# puppet-initial RPM's systemd bootstrap unit).
|
|
BOOTAPI_PUPPET_CA_URL=puppetca.k8s.syd1.au.unkin.net
|
|
|
|
# --- network defaults (used when NetBox records none per-device) ---
|
|
BOOTAPI_DOMAIN=main.unkin.net
|
|
# k8s bind-resolvers LoadBalancer (replaces the legacy VM resolvers).
|
|
BOOTAPI_NAMESERVERS=198.18.200.7
|
|
|
|
# --- render-time secrets (NEVER stored in NetBox; from Vault in k8s) ---
|
|
# crypt(3) hash for the root account. Empty => root account locked.
|
|
BOOTAPI_ROOT_PASSWORD_HASH=
|
|
# BOOTAPI_ROOT_PASSWORD_HASH_FILE=/var/run/secrets/bootapi/root_password_hash
|
|
# Newline-separated SSH public keys installed for root.
|
|
BOOTAPI_SSH_AUTHORIZED_KEYS=
|
|
|
|
# --- unknown-MAC fallback: "local" (safe: boot local disk) or "shell" (debug) ---
|
|
BOOTAPI_UNKNOWN_MAC_FALLBACK=local
|