seon
8ddf12c588
Terraform 설계서 7.2·7.3의 WP-07 내용. - bootstrap/kubeadm/init-cp.sh: kubeadm init(사설 IP advertise, EIP cert SAN, pod CIDR 10.244.0.0/16) → flannel v0.28.9 → Argo CD v3.5.3(server-side apply) → root-app 적용 → 워커 join 명령을 /opt/selfheal/join.sh(0600)에 저장. 재실행 안전. - bootstrap/kubeadm/join-worker.sh: join 명령을 stdin으로 받아 실행(토큰이 터미널·로그에 남지 않음). 이미 join된 노드는 0으로 종료. - argocd/root-app.yaml: apps/ 재귀 app-of-apps(공개 저장소, 자격증명 불요). - apps/rbac.yaml + workloads/rbac: 네임스페이스 chaos-mesh·demo, SA harness(ClusterRole selfheal-harness: chaos-mesh.org/*, deployments·scale, pods, nodes patch, pods/eviction), SA ai-reader(ClusterRole view).
13 lines
749 B
Bash
Executable File
13 lines
749 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Worker join (Terraform design 7.2). Feed the join command produced on the CP through stdin, from the operator host:
|
|
# ssh -i ~/.ssh/selfheal-lab ubuntu@<CP_EIP> 'sudo cat /opt/selfheal/join.sh' \
|
|
# | ssh -i ~/.ssh/selfheal-lab -J ubuntu@<CP_EIP> ubuntu@<worker private ip> 'sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/join-worker.sh'
|
|
# The token never touches the operator terminal or a log. Safe to re-run: a joined node exits 0.
|
|
set -euo pipefail
|
|
if [ -f /etc/kubernetes/kubelet.conf ]; then echo "already joined"; exit 0; fi
|
|
JOIN="$(cat)"
|
|
case "$JOIN" in kubeadm\ join*) ;; *) echo "stdin is not a kubeadm join command" >&2; exit 1;; esac
|
|
# shellcheck disable=SC2086
|
|
$JOIN --node-name "$(hostname)"
|
|
echo "joined"
|