feat: add kubeadm bootstrap, Argo CD root app and lab RBAC
Terraform 설계서 7.2·7.3의 WP-07 내용. - bootstrap/kubeadm/init-cp.sh: kubeadm init(사설 IP advertise, EIP cert SAN, pod CIDR 10.244.0.0/16) → flannel v0.28.9 → Argo CD v3.5.3(server-side apply) → root-app 적용 → 워커 join 명령을 /opt/selfheal/join.sh(0600)에 저장. 재실행 안전. - bootstrap/kubeadm/join-worker.sh: join 명령을 stdin으로 받아 실행(토큰이 터미널·로그에 남지 않음). 이미 join된 노드는 0으로 종료. - argocd/root-app.yaml: apps/ 재귀 app-of-apps(공개 저장소, 자격증명 불요). - apps/rbac.yaml + workloads/rbac: 네임스페이스 chaos-mesh·demo, SA harness(ClusterRole selfheal-harness: chaos-mesh.org/*, deployments·scale, pods, nodes patch, pods/eviction), SA ai-reader(ClusterRole view).
This commit is contained in:
seon committed
1 parent
390a903dbb
commit
8ddf12c588
9 files changed
+165
-6
No files matched your search
@@ -0,0 +1,21 @@
|
||||
# Namespaces and the two lab ServiceAccounts (design 6.11 / 7.3): harness (chaos-mesh) and ai-reader (demo).
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: rbac
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://git.seonology.com/selfheal-lab/selfheal-lab-gitops.git
|
||||
targetRevision: main
|
||||
path: workloads/rbac
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- ServerSideApply=true
|
||||
@@ -1,3 +0,0 @@
|
||||
# argocd
|
||||
|
||||
Placeholder. See the root README for the work package that fills this directory.
|
||||
@@ -0,0 +1,26 @@
|
||||
# app-of-apps root (Terraform design 7.2 / 7.3). Applied once by init-cp.sh; everything under apps/ is then Git-driven.
|
||||
# The gitops repository is public, so no repository credential is needed.
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: root
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://git.seonology.com/selfheal-lab/selfheal-lab-gitops.git
|
||||
targetRevision: main
|
||||
path: apps
|
||||
directory:
|
||||
recurse: true
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: argocd
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- ServerSideApply=true
|
||||
@@ -1,3 +0,0 @@
|
||||
# bootstrap/kubeadm
|
||||
|
||||
Placeholder. See the root README for the work package that fills this directory.
|
||||
Executable
+37
@@ -0,0 +1,37 @@
|
||||
#!/usr/bin/env bash
|
||||
# Control-plane bootstrap (Terraform design 7.2). Run ONCE on the CP as root after cloud-init finished:
|
||||
# sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/init-cp.sh
|
||||
# Re-running is safe: kubeadm init is skipped when /etc/kubernetes/admin.conf exists; the rest is idempotent apply.
|
||||
set -euo pipefail
|
||||
FLANNEL_VERSION="${FLANNEL_VERSION:-v0.28.9}" # https://github.com/flannel-io/flannel/releases
|
||||
ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.3}" # https://github.com/argoproj/argo-cd/releases
|
||||
GITOPS_DIR="${GITOPS_DIR:-/opt/selfheal/gitops}"
|
||||
# shellcheck disable=SC1091
|
||||
. /opt/selfheal/node.env # ROLE, POD_CIDR, CP_PRIVATE_IP, CP_PUBLIC_IP (written by cloud-init)
|
||||
[ "$ROLE" = cp ] || { echo "not a control plane node (ROLE=$ROLE)" >&2; exit 1; }
|
||||
|
||||
if [ ! -f /etc/kubernetes/admin.conf ]; then
|
||||
# advertise on the private IP (VPN peers and workers reach it); the EIP goes into the API server cert SANs
|
||||
kubeadm init \
|
||||
--pod-network-cidr="$POD_CIDR" \
|
||||
--apiserver-advertise-address="$CP_PRIVATE_IP" \
|
||||
--apiserver-cert-extra-sans="$CP_PUBLIC_IP" \
|
||||
--node-name "$(hostname)"
|
||||
fi
|
||||
export KUBECONFIG=/etc/kubernetes/admin.conf
|
||||
install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.kube
|
||||
install -m 600 -o ubuntu -g ubuntu /etc/kubernetes/admin.conf /home/ubuntu/.kube/config
|
||||
|
||||
# CNI: flannel (pod CIDR 10.244.0.0/16 matches its default; ip-masq gives pods the node IP towards the VPN, design 8)
|
||||
kubectl apply -f "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml"
|
||||
|
||||
# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit.
|
||||
kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
|
||||
kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml"
|
||||
kubectl -n argocd rollout status deploy/argocd-server --timeout=600s
|
||||
kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml"
|
||||
|
||||
# Worker join command (bootstrap token, 24h). Copy it to each worker: see join-worker.sh
|
||||
kubeadm token create --print-join-command > /opt/selfheal/join.sh
|
||||
chmod 600 /opt/selfheal/join.sh
|
||||
echo "control plane ready; join command in /opt/selfheal/join.sh"
|
||||
Executable
+12
@@ -0,0 +1,12 @@
|
||||
#!/usr/bin/env bash
|
||||
# Worker join (Terraform design 7.2). Feed the join command produced on the CP through stdin, from the operator host:
|
||||
# ssh -i ~/.ssh/selfheal-lab ubuntu@<CP_EIP> 'sudo cat /opt/selfheal/join.sh' \
|
||||
# | ssh -i ~/.ssh/selfheal-lab -J ubuntu@<CP_EIP> ubuntu@<worker private ip> 'sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/join-worker.sh'
|
||||
# The token never touches the operator terminal or a log. Safe to re-run: a joined node exits 0.
|
||||
set -euo pipefail
|
||||
if [ -f /etc/kubernetes/kubelet.conf ]; then echo "already joined"; exit 0; fi
|
||||
JOIN="$(cat)"
|
||||
case "$JOIN" in kubeadm\ join*) ;; *) echo "stdin is not a kubeadm join command" >&2; exit 1;; esac
|
||||
# shellcheck disable=SC2086
|
||||
$JOIN --node-name "$(hostname)"
|
||||
echo "joined"
|
||||
@@ -0,0 +1,19 @@
|
||||
# AI VM read-only identity (Terraform design 6.11): built-in ClusterRole view.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ai-reader
|
||||
namespace: demo
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: selfheal-ai-reader-view
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: view
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ai-reader
|
||||
namespace: demo
|
||||
@@ -0,0 +1,41 @@
|
||||
# harness runner identity (Terraform design 6.11): Chaos Mesh CRs, rollout/scale, pod reads, cordon/drain.
|
||||
# Tokens are minted by `make token` (kubectl create token harness -n chaos-mesh --duration 24h) into Secret Manager.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: harness
|
||||
namespace: chaos-mesh
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: selfheal-harness
|
||||
rules:
|
||||
- apiGroups: ["chaos-mesh.org"]
|
||||
resources: ["*"]
|
||||
verbs: ["*"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "deployments/scale"]
|
||||
verbs: ["get", "list", "watch", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/eviction"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: selfheal-harness
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: selfheal-harness
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: harness
|
||||
namespace: chaos-mesh
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: chaos-mesh
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: demo
|
||||
Reference in new issue
Block a user