unkinben
aeae26711f
## Summary - Replace static `registries.yaml` with EPP template driven by `rke2::registries` hash - Add `disable-default-registry-endpoint: true` to all mirrors — RKE2 will only use artifactapi and never fall back to upstream registries - Registry configuration now fully managed via hiera data (`roles/infra/k8s.yaml`) Reviewed-on: #474 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
106 lines
3.0 KiB
Puppet
106 lines
3.0 KiB
Puppet
# config rke2
|
|
class rke2::config (
|
|
Enum['server', 'agent'] $node_type = $rke2::node_type,
|
|
Stdlib::Absolutepath $config_file = $rke2::config_file,
|
|
Hash $config_hash = $rke2::config_hash,
|
|
Stdlib::HTTPSUrl $join_url = $rke2::join_url,
|
|
Stdlib::Fqdn $bootstrap_node = $rke2::bootstrap_node,
|
|
String $node_token = $rke2::node_token,
|
|
Array[String[1]] $extra_config_files = $rke2::extra_config_files,
|
|
Boolean $manage_registries = $rke2::manage_registries,
|
|
Hash $registries = $rke2::registries,
|
|
){
|
|
|
|
# if its not the bootstrap node, add join path to config
|
|
if $node_type == 'server' {
|
|
if $trusted['certname'] != $bootstrap_node {
|
|
$config = merge($config_hash, {
|
|
server => $join_url,
|
|
token => $node_token,
|
|
} )
|
|
}else{
|
|
$config = merge($config_hash, {})
|
|
}
|
|
} elsif $node_type == 'agent' {
|
|
$config = merge($config_hash, {
|
|
server => $join_url,
|
|
token => $node_token,
|
|
} )
|
|
}else{
|
|
$config = $config_hash
|
|
}
|
|
|
|
if $manage_registries {
|
|
file { '/etc/rancher/rke2/registries.yaml':
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => epp('rke2/registries.yaml.epp', { registries => $registries }),
|
|
require => Package["rke2-${node_type}"],
|
|
notify => Service["rke2-${node_type}"],
|
|
}
|
|
}else{
|
|
file { '/etc/rancher/rke2/registries.yaml':
|
|
ensure => absent,
|
|
require => Package["rke2-${node_type}"],
|
|
notify => Service["rke2-${node_type}"],
|
|
}
|
|
}
|
|
|
|
# create the config file
|
|
file { $config_file:
|
|
ensure => file,
|
|
content => Sensitive($config.to_yaml),
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
require => Package["rke2-${node_type}"],
|
|
before => Service["rke2-${node_type}"],
|
|
}
|
|
|
|
# create a script to verify k8s api is up (used by consul)
|
|
file {'/usr/local/bin/check_k8s_api.sh':
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0755',
|
|
source => 'puppet:///modules/rke2/check_k8s_api.sh',
|
|
}
|
|
|
|
# symlink kubectl to path
|
|
file {'/usr/bin/kubectl':
|
|
ensure => link,
|
|
target => '/var/lib/rancher/rke2/bin/kubectl',
|
|
require => Package["rke2-${node_type}"],
|
|
}
|
|
|
|
# when ProtectKernelDefaults=true
|
|
sysctl { 'vm.overcommit_memory':
|
|
value => '1',
|
|
before => Service["rke2-${node_type}"],
|
|
}
|
|
sysctl { 'kernel.panic':
|
|
value => '10',
|
|
before => Service["rke2-${node_type}"],
|
|
}
|
|
|
|
# on the controller nodes only
|
|
if $node_type == 'server' and $facts['k8s_masters'] and $facts['k8s_masters'] > 2 {
|
|
|
|
# manage extra config config (these are not dependent on helm)
|
|
$extra_config_files.each |$file| {
|
|
|
|
file {"/var/lib/rancher/rke2/server/manifests/${file}.yaml":
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
source => "puppet:///modules/rke2/${file}.yaml",
|
|
require => Service['rke2-server'],
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|