seon
31334fac72
CP는 NoSchedule taint를 유지하므로 워커가 join하기 전에는 Argo CD 파드가 Pending이다. 롤아웃 대기를 빼고 join 명령 저장을 앞으로 옮긴다.
38 lines
2.3 KiB
Bash
Executable File
38 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Control-plane bootstrap (Terraform design 7.2). Run ONCE on the CP as root after cloud-init finished:
|
|
# sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/init-cp.sh
|
|
# Re-running is safe: kubeadm init is skipped when /etc/kubernetes/admin.conf exists; the rest is idempotent apply.
|
|
set -euo pipefail
|
|
FLANNEL_VERSION="${FLANNEL_VERSION:-v0.28.9}" # https://github.com/flannel-io/flannel/releases
|
|
ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.3}" # https://github.com/argoproj/argo-cd/releases
|
|
GITOPS_DIR="${GITOPS_DIR:-/opt/selfheal/gitops}"
|
|
# shellcheck disable=SC1091
|
|
. /opt/selfheal/node.env # ROLE, POD_CIDR, CP_PRIVATE_IP, CP_PUBLIC_IP (written by cloud-init)
|
|
[ "$ROLE" = cp ] || { echo "not a control plane node (ROLE=$ROLE)" >&2; exit 1; }
|
|
|
|
if [ ! -f /etc/kubernetes/admin.conf ]; then
|
|
# advertise on the private IP (VPN peers and workers reach it); the EIP goes into the API server cert SANs
|
|
kubeadm init \
|
|
--pod-network-cidr="$POD_CIDR" \
|
|
--apiserver-advertise-address="$CP_PRIVATE_IP" \
|
|
--apiserver-cert-extra-sans="$CP_PUBLIC_IP" \
|
|
--node-name "$(hostname)"
|
|
fi
|
|
export KUBECONFIG=/etc/kubernetes/admin.conf
|
|
install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.kube
|
|
install -m 600 -o ubuntu -g ubuntu /etc/kubernetes/admin.conf /home/ubuntu/.kube/config
|
|
|
|
# CNI: flannel (pod CIDR 10.244.0.0/16 matches its default; ip-masq gives pods the node IP towards the VPN, design 8)
|
|
kubectl apply -f "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml"
|
|
|
|
# Worker join command (bootstrap token, 24h). Copy it to each worker: see join-worker.sh
|
|
kubeadm token create --print-join-command > /opt/selfheal/join.sh
|
|
chmod 600 /opt/selfheal/join.sh
|
|
|
|
# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit.
|
|
# Argo CD pods only schedule once workers have joined (the CP keeps its NoSchedule taint), so do not wait here.
|
|
kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
|
|
kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml"
|
|
kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml"
|
|
echo "control plane ready; join the workers (join command in /opt/selfheal/join.sh), then: kubectl -n argocd rollout status deploy/argocd-server"
|