From 01f0ffffd2776d083be052d11061b84c027c9a1b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 27 Sep 2025 15:02:05 +1000 Subject: [PATCH] feat: moderate the k8s install - only install a base config - wait for 3 masters before deploying helm charts - remove cluster-domain --- hieradata/roles/infra/k8s.eyaml | 2 +- hieradata/roles/infra/k8s/control.yaml | 3 +- modules/rke2/lib/facter/k8s_masters.rb | 39 ++++++++++++++++++++++++++ modules/rke2/manifests/config.pp | 28 +++++++++--------- modules/rke2/manifests/helm.pp | 4 +-- 5 files changed, 56 insertions(+), 20 deletions(-) create mode 100644 modules/rke2/lib/facter/k8s_masters.rb diff --git a/hieradata/roles/infra/k8s.eyaml b/hieradata/roles/infra/k8s.eyaml index 56f2d4b..78340d6 100644 --- a/hieradata/roles/infra/k8s.eyaml +++ b/hieradata/roles/infra/k8s.eyaml @@ -1 +1 @@ -rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAPRBcsDJv/SDR4pOi4fBWzU2ayCXW8BaATzpg3h8mHsVPcHwhfL9w9d4BIshM5yzSZwfmj8EBMk6sa4vEcBRN5r5vWDETnjwsvtLULvyiPm5WVYAYe+Z/fzoCUqswWvXrU/yzoMd/oUYFOrtCB0wT4bZX2leg64CQ7DZIf4wZod0Z9EH7YwUpL4mmbLWY29w0Z3F702O8v0hp9J7IWX5A5ob8OLaTy9SmApZEtm35UDz+OAaJ1OZ9yc2pWTkVZ0dSgMvouynJWToZ/k0ZwoW5I32WLeZ6mkYODwXF1ULqVTX3eX/c9HlVilHJar9TlcY46+8ypV3Uoju8j6c86DaRtjCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQe3h1bWn1G2HYEwupc7n3EoBwzcA4ICV4efMd1n4d1CW+wlBAoa5T8lXSluf09vajUQmaFhl3pl99v3uc5M38ePPd5QkzoZPfb4kLcmuufGNfwbIXpaQQ+nwQATOX1UG5SOEovshvWnW0iF5JrgIa+MLed9WF48NMbvZZLbwyBe7hrQ==] +rke2::node_token: ENC[PKCS7,MIIB2gYJKoZIhvcNAQcDoIIByzCCAccCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAOD+w5nJFqEYWFj+tZQ65Oi19eDhaWtpLQ0gwEdBtMmY9sPJ63l1q2qH933NH6TOd1UlMDvGfoDLCae+yt/MAW//cJ15X3QbiVQ23DdfCOlUEZN6fjVrveEt/yIeFQmWvnkMS4pRfPbgQu2OHm37PpuPE7s6dUyGItAYjchrRhtQ7ibhXDnN7miG+oVRXP2T8b/V5WPdmA222DSV6r/AnqaWkna9W/oh/I2sNKeEm5q3f8bh8Gxt1dDy3VwaZ3lAh3uR+SUm7P/6PTYw8opxiumFBvos0mRiXIdOwUuqrAS8hafWBhxnDLlTBfz62Nc4wQmQ8gz0bHJZSipH9G6mIEDCBnAYJKoZIhvcNAQcBMB0GCWCGSAFlAwQBKgQQ2WG6ROWFlQdXx0TuO5oABoBwTDtAXIj7y6I1B3zCnFoMHETf5d7ulPGdgwZsENf0UIHpg2l0w503MUHHbu6YDFiDiTE0oDNJPVHid7TO+XwWFgh5v1MWi/XeEBgCs6nMCW8qkX0Z3UXaZdSBUll1M4sRtuqscBnoD/LLs2kKfxrqQg==] diff --git a/hieradata/roles/infra/k8s/control.yaml b/hieradata/roles/infra/k8s/control.yaml index 28a130e..894320f 100644 --- a/hieradata/roles/infra/k8s/control.yaml +++ b/hieradata/roles/infra/k8s/control.yaml @@ -28,10 +28,9 @@ rke2::csi_ceph_templates: - ceph-csi-secret rke2::extra_config_files: - rke2-canal-config - - service-loadbalancer-nginx +# - service-loadbalancer-nginx rke2::config_hash: advertise-address: "%{hiera('networking_loopback0_ip')}" - cluster-domain: "svc.k8s.unkin.net" tls-san: - "join-k8s.service.consul" - "api-k8s.service.consul" diff --git a/modules/rke2/lib/facter/k8s_masters.rb b/modules/rke2/lib/facter/k8s_masters.rb new file mode 100644 index 0000000..33b9c84 --- /dev/null +++ b/modules/rke2/lib/facter/k8s_masters.rb @@ -0,0 +1,39 @@ +# frozen_string_literal: true + +require 'json' +require 'open3' + +Facter.add(:k8s_masters) do + confine do + File.exist?('/etc/rancher/rke2/rke2.yaml') && + File.executable?('/usr/bin/kubectl') + end + + setcode do + env = { 'KUBECONFIG' => '/etc/rancher/rke2/rke2.yaml' } + cmd = ['/usr/bin/kubectl', 'get', 'nodes', '-o', 'json'] + + stdout, stderr, status = Open3.capture3(env, *cmd) + + if status.success? + json = JSON.parse(stdout) + + master_count = json['items'].count do |item| + roles = item.dig('metadata', 'labels') || {} + + # Look for well-known labels assigned to control-plane nodes + roles.any? do |key, _| + key =~ %r{node-role\.kubernetes\.io/(control-plane|master|etcd)} + end + end + + master_count + else + Facter.debug("kubectl error: #{stderr}") + 0 + end + rescue StandardError => e + Facter.debug("Exception in k8s_masters fact: #{e.message}") + 0 + end +end diff --git a/modules/rke2/manifests/config.pp b/modules/rke2/manifests/config.pp index e4affb7..cb17c77 100644 --- a/modules/rke2/manifests/config.pp +++ b/modules/rke2/manifests/config.pp @@ -24,9 +24,7 @@ class rke2::config ( token => $node_token, } ) }else{ - $config = merge($config_hash, { - token => $node_token, - } ) + $config = merge($config_hash, {}) } } elsif $node_type == 'agent' { $config = merge($config_hash, { @@ -75,7 +73,7 @@ class rke2::config ( } # on the controller nodes only - if $node_type == 'server' { + if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 { # wait for purelb helm to setup namespace if 'purelb' in $facts['k8s_namespaces'] { @@ -89,17 +87,17 @@ class rke2::config ( } } - # wait for rancher helm to setup namespace - if 'cattle-system' in $facts['k8s_namespaces'] { - file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml': - ensure => file, - owner => 'root', - group => 'root', - mode => '0644', - source => 'puppet:///modules/rke2/ingress-route-rancher.yaml', - require => Service['rke2-server'], - } - } + ## wait for rancher helm to setup namespace + #if 'cattle-system' in $facts['k8s_namespaces'] { + # file {'/var/lib/rancher/rke2/server/manifests/ingress-route-rancher.yaml': + # ensure => file, + # owner => 'root', + # group => 'root', + # mode => '0644', + # source => 'puppet:///modules/rke2/ingress-route-rancher.yaml', + # require => Service['rke2-server'], + # } + #} # manage extra config config (these are not dependent on helm) $extra_config_files.each |$file| { diff --git a/modules/rke2/manifests/helm.pp b/modules/rke2/manifests/helm.pp index e172f2e..8eb5536 100644 --- a/modules/rke2/manifests/helm.pp +++ b/modules/rke2/manifests/helm.pp @@ -20,8 +20,8 @@ class rke2::helm ( mode => '0755', } - # on the controller nodes only - if $node_type == 'server' { + # on the controller nodes only, and after 3 master nodes exist + if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 { # check if the repo already exists $helm_repos.each | String $repo, Stdlib::HTTPSUrl $url | {