From 8ddf12c588050abe68544018b34c4b142ef8bfe9 Mon Sep 17 00:00:00 2001 From: seonNoh Date: Thu, 24 Sep 2026 00:09:24 +0900 Subject: [PATCH] feat: add kubeadm bootstrap, Argo CD root app and lab RBAC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Terraform 설계서 7.2·7.3의 WP-07 내용. - bootstrap/kubeadm/init-cp.sh: kubeadm init(사설 IP advertise, EIP cert SAN, pod CIDR 10.244.0.0/16) → flannel v0.28.9 → Argo CD v3.5.3(server-side apply) → root-app 적용 → 워커 join 명령을 /opt/selfheal/join.sh(0600)에 저장. 재실행 안전. - bootstrap/kubeadm/join-worker.sh: join 명령을 stdin으로 받아 실행(토큰이 터미널·로그에 남지 않음). 이미 join된 노드는 0으로 종료. - argocd/root-app.yaml: apps/ 재귀 app-of-apps(공개 저장소, 자격증명 불요). - apps/rbac.yaml + workloads/rbac: 네임스페이스 chaos-mesh·demo, SA harness(ClusterRole selfheal-harness: chaos-mesh.org/*, deployments·scale, pods, nodes patch, pods/eviction), SA ai-reader(ClusterRole view). --- apps/rbac.yaml | 21 ++++++++++++++++ argocd/README.md | 3 --- argocd/root-app.yaml | 26 ++++++++++++++++++++ bootstrap/kubeadm/README.md | 3 --- bootstrap/kubeadm/init-cp.sh | 37 ++++++++++++++++++++++++++++ bootstrap/kubeadm/join-worker.sh | 12 ++++++++++ workloads/rbac/ai-reader.yaml | 19 +++++++++++++++ workloads/rbac/harness.yaml | 41 ++++++++++++++++++++++++++++++++ workloads/rbac/namespaces.yaml | 9 +++++++ 9 files changed, 165 insertions(+), 6 deletions(-) create mode 100644 apps/rbac.yaml delete mode 100644 argocd/README.md create mode 100644 argocd/root-app.yaml delete mode 100644 bootstrap/kubeadm/README.md create mode 100755 bootstrap/kubeadm/init-cp.sh create mode 100755 bootstrap/kubeadm/join-worker.sh create mode 100644 workloads/rbac/ai-reader.yaml create mode 100644 workloads/rbac/harness.yaml create mode 100644 workloads/rbac/namespaces.yaml diff --git a/apps/rbac.yaml b/apps/rbac.yaml new file mode 100644 index 0000000..5ef4d26 --- /dev/null +++ b/apps/rbac.yaml @@ -0,0 +1,21 @@ +# Namespaces and the two lab ServiceAccounts (design 6.11 / 7.3): harness (chaos-mesh) and ai-reader (demo). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: rbac + namespace: argocd +spec: + project: default + source: + repoURL: https://git.seonology.com/selfheal-lab/selfheal-lab-gitops.git + targetRevision: main + path: workloads/rbac + destination: + server: https://kubernetes.default.svc + namespace: default + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - ServerSideApply=true diff --git a/argocd/README.md b/argocd/README.md deleted file mode 100644 index 690a09d..0000000 --- a/argocd/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# argocd - -Placeholder. See the root README for the work package that fills this directory. diff --git a/argocd/root-app.yaml b/argocd/root-app.yaml new file mode 100644 index 0000000..8bbb09b --- /dev/null +++ b/argocd/root-app.yaml @@ -0,0 +1,26 @@ +# app-of-apps root (Terraform design 7.2 / 7.3). Applied once by init-cp.sh; everything under apps/ is then Git-driven. +# The gitops repository is public, so no repository credential is needed. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: root + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: https://git.seonology.com/selfheal-lab/selfheal-lab-gitops.git + targetRevision: main + path: apps + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - ServerSideApply=true diff --git a/bootstrap/kubeadm/README.md b/bootstrap/kubeadm/README.md deleted file mode 100644 index c4375f2..0000000 --- a/bootstrap/kubeadm/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# bootstrap/kubeadm - -Placeholder. See the root README for the work package that fills this directory. diff --git a/bootstrap/kubeadm/init-cp.sh b/bootstrap/kubeadm/init-cp.sh new file mode 100755 index 0000000..08ae335 --- /dev/null +++ b/bootstrap/kubeadm/init-cp.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env bash +# Control-plane bootstrap (Terraform design 7.2). Run ONCE on the CP as root after cloud-init finished: +# sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/init-cp.sh +# Re-running is safe: kubeadm init is skipped when /etc/kubernetes/admin.conf exists; the rest is idempotent apply. +set -euo pipefail +FLANNEL_VERSION="${FLANNEL_VERSION:-v0.28.9}" # https://github.com/flannel-io/flannel/releases +ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.3}" # https://github.com/argoproj/argo-cd/releases +GITOPS_DIR="${GITOPS_DIR:-/opt/selfheal/gitops}" +# shellcheck disable=SC1091 +. /opt/selfheal/node.env # ROLE, POD_CIDR, CP_PRIVATE_IP, CP_PUBLIC_IP (written by cloud-init) +[ "$ROLE" = cp ] || { echo "not a control plane node (ROLE=$ROLE)" >&2; exit 1; } + +if [ ! -f /etc/kubernetes/admin.conf ]; then + # advertise on the private IP (VPN peers and workers reach it); the EIP goes into the API server cert SANs + kubeadm init \ + --pod-network-cidr="$POD_CIDR" \ + --apiserver-advertise-address="$CP_PRIVATE_IP" \ + --apiserver-cert-extra-sans="$CP_PUBLIC_IP" \ + --node-name "$(hostname)" +fi +export KUBECONFIG=/etc/kubernetes/admin.conf +install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.kube +install -m 600 -o ubuntu -g ubuntu /etc/kubernetes/admin.conf /home/ubuntu/.kube/config + +# CNI: flannel (pod CIDR 10.244.0.0/16 matches its default; ip-masq gives pods the node IP towards the VPN, design 8) +kubectl apply -f "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml" + +# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit. +kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f - +kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml" +kubectl -n argocd rollout status deploy/argocd-server --timeout=600s +kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml" + +# Worker join command (bootstrap token, 24h). Copy it to each worker: see join-worker.sh +kubeadm token create --print-join-command > /opt/selfheal/join.sh +chmod 600 /opt/selfheal/join.sh +echo "control plane ready; join command in /opt/selfheal/join.sh" diff --git a/bootstrap/kubeadm/join-worker.sh b/bootstrap/kubeadm/join-worker.sh new file mode 100755 index 0000000..9c4a3d3 --- /dev/null +++ b/bootstrap/kubeadm/join-worker.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash +# Worker join (Terraform design 7.2). Feed the join command produced on the CP through stdin, from the operator host: +# ssh -i ~/.ssh/selfheal-lab ubuntu@ 'sudo cat /opt/selfheal/join.sh' \ +# | ssh -i ~/.ssh/selfheal-lab -J ubuntu@ ubuntu@ 'sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/join-worker.sh' +# The token never touches the operator terminal or a log. Safe to re-run: a joined node exits 0. +set -euo pipefail +if [ -f /etc/kubernetes/kubelet.conf ]; then echo "already joined"; exit 0; fi +JOIN="$(cat)" +case "$JOIN" in kubeadm\ join*) ;; *) echo "stdin is not a kubeadm join command" >&2; exit 1;; esac +# shellcheck disable=SC2086 +$JOIN --node-name "$(hostname)" +echo "joined" diff --git a/workloads/rbac/ai-reader.yaml b/workloads/rbac/ai-reader.yaml new file mode 100644 index 0000000..5e58281 --- /dev/null +++ b/workloads/rbac/ai-reader.yaml @@ -0,0 +1,19 @@ +# AI VM read-only identity (Terraform design 6.11): built-in ClusterRole view. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ai-reader + namespace: demo +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: selfheal-ai-reader-view +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: + - kind: ServiceAccount + name: ai-reader + namespace: demo diff --git a/workloads/rbac/harness.yaml b/workloads/rbac/harness.yaml new file mode 100644 index 0000000..4a6b21e --- /dev/null +++ b/workloads/rbac/harness.yaml @@ -0,0 +1,41 @@ +# harness runner identity (Terraform design 6.11): Chaos Mesh CRs, rollout/scale, pod reads, cordon/drain. +# Tokens are minted by `make token` (kubectl create token harness -n chaos-mesh --duration 24h) into Secret Manager. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: harness + namespace: chaos-mesh +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: selfheal-harness +rules: + - apiGroups: ["chaos-mesh.org"] + resources: ["*"] + verbs: ["*"] + - apiGroups: ["apps"] + resources: ["deployments", "deployments/scale"] + verbs: ["get", "list", "watch", "patch"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch", "patch"] + - apiGroups: [""] + resources: ["pods/eviction"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: selfheal-harness +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: selfheal-harness +subjects: + - kind: ServiceAccount + name: harness + namespace: chaos-mesh diff --git a/workloads/rbac/namespaces.yaml b/workloads/rbac/namespaces.yaml new file mode 100644 index 0000000..b93b4b6 --- /dev/null +++ b/workloads/rbac/namespaces.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: chaos-mesh +--- +apiVersion: v1 +kind: Namespace +metadata: + name: demo