From 73d9f92a2ed9907b47fb6253b6b94d29d890ba74 Mon Sep 17 00:00:00 2001 From: CodeGit Date: Wed, 19 Aug 2026 08:40:08 +0100 Subject: [PATCH] docs: use default SSH key name, install kubectl, fix .kube dir Rename k8s's key from the custom k3s_homelab to the default id_ed25519 - the custom name had no real justification (k8s is a fresh account with nothing to collide with) and caused a real bug: OpenSSH only auto-offers default-named keys, so ssh commands lacking an explicit -i silently failed to authenticate. Also add the never-actually-documented kubectl install step, and mkdir -p ~/.kube before the first redirect into it, in both SETUP.md and QUICKSTART.md. --- docs/QUICKSTART.md | 21 ++++++++++++++++++--- docs/SETUP.md | 20 +++++++++++++++++--- terraform/terraform.tfvars.example | 2 +- 3 files changed, 36 insertions(+), 7 deletions(-) diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md index 8251d56..fbf1c73 100644 --- a/docs/QUICKSTART.md +++ b/docs/QUICKSTART.md @@ -10,7 +10,7 @@ and provision the "real" 3-node cluster properly instead. Shares steps 1–4 of `docs/SETUP.md` as prerequisites — do those first if you haven't: - Step 1: KVM/libvirt installed on the T630. -- Step 2: the unprivileged `k8s` user exists, with `~/.ssh/k3s_homelab` +- Step 2: the unprivileged `k8s` user exists, with `~/.ssh/id_ed25519` generated. - Step 3: `openssl rand -hex 32` isn't needed here (no agents joining, so no cluster token) — skip it. @@ -92,7 +92,7 @@ virsh -c qemu:///system vol-list --pool default # should list both volumes ``` Write the cloud-init user-data — paste in the contents of -`~/.ssh/k3s_homelab.pub` where marked: +`~/.ssh/id_ed25519.pub` where marked: ```sh mkdir -p ~/vms @@ -107,7 +107,7 @@ users: shell: /bin/bash sudo: ALL=(ALL) NOPASSWD:ALL ssh_authorized_keys: - - PASTE ~/.ssh/k3s_homelab.pub CONTENTS HERE + - PASTE ~/.ssh/id_ed25519.pub CONTENTS HERE package_update: true packages: @@ -162,7 +162,22 @@ Give cloud-init ~2 minutes to finish installing k3s after the VM boots. ```sh virsh -c qemu:///system domifaddr k3s-manual # note the IP under the default network +``` +If you haven't installed `kubectl` on the T630 yet (as `k8s`, no sudo +needed): + +```sh +curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" +chmod +x kubectl +mkdir -p ~/.local/bin +mv kubectl ~/.local/bin/ +echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc +export PATH="$HOME/.local/bin:$PATH" +``` + +```sh +mkdir -p ~/.kube ssh k3s@ sudo cat /etc/rancher/k3s/k3s.yaml \ | sed "s/127.0.0.1//" > ~/.kube/config-manual diff --git a/docs/SETUP.md b/docs/SETUP.md index b5e8e61..27e8497 100644 --- a/docs/SETUP.md +++ b/docs/SETUP.md @@ -48,7 +48,7 @@ sudo loginctl enable-linger k8s # lets its services keep running after # as k8s, from here on (sudo -iu, not su -, since k8s has no password set): sudo -iu k8s -ssh-keygen -t ed25519 -C "k3s-homelab" -f ~/.ssh/k3s_homelab # only needed if you'll SSH in as k8s day-to-day +ssh-keygen -t ed25519 -C "k3s-homelab" -f ~/.ssh/id_ed25519 # only needed if you'll SSH in as k8s day-to-day virsh -c qemu:///system list --all # sanity check: should run with no permission error, no sudo ``` @@ -100,7 +100,7 @@ references — no placeholder-swapping needed). reuse that same in-cluster Secret) — it's never written to `k8s`'s filesystem at all. - Using HTTPS tokens instead of `k8s`'s SSH key (`~/.ssh/k3s_homelab`, from + Using HTTPS tokens instead of `k8s`'s SSH key (`~/.ssh/id_ed25519`, from step 2) sidesteps an open question: Forgejo's git-SSH port isn't reachable from this desktop through your router (see the SSH troubleshooting earlier in this conversation), and whether it's reachable @@ -136,7 +136,7 @@ chmod 600 ~/.git-credentials cd ~/k3s/terraform cp terraform.tfvars.example terraform.tfvars -# edit terraform.tfvars: ssh_public_key (contents of ~/.ssh/k3s_homelab.pub +# edit terraform.tfvars: ssh_public_key (contents of ~/.ssh/id_ed25519.pub # from step 2), k3s_token. Defaults for network/sizing are fine to start. tofu init @@ -154,7 +154,21 @@ each on first boot — give it ~2 minutes after `apply` finishes. ## 6. Get kubectl talking to the cluster +`kubectl` itself was never actually installed anywhere earlier in this +guide despite being listed as a prerequisite — install it now (as `k8s`, +no sudo needed, same pattern as the OpenTofu install): + ```sh +curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" +chmod +x kubectl +mkdir -p ~/.local/bin +mv kubectl ~/.local/bin/ +echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc +export PATH="$HOME/.local/bin:$PATH" +``` + +```sh +mkdir -p ~/.kube ssh k3s@$(tofu output -raw server_ip) sudo cat /etc/rancher/k3s/k3s.yaml \ | sed "s/127.0.0.1/$(tofu output -raw server_ip)/" > ~/.kube/config-homelab diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example index e49befb..38071b0 100644 --- a/terraform/terraform.tfvars.example +++ b/terraform/terraform.tfvars.example @@ -4,7 +4,7 @@ # Default (qemu:///system) assumes you're running tofu on the T630 itself # as the 'k8s' user - see docs/SETUP.md step 2. Leave commented out unless # you're running Terraform from a separate workstation instead. -# libvirt_uri = "qemu+ssh://k8s@t630.lan/system?keyfile=/home/you/.ssh/k3s_homelab" +# libvirt_uri = "qemu+ssh://k8s@t630.lan/system?keyfile=/home/you/.ssh/id_ed25519" ssh_public_key = "ssh-ed25519 AAAA... you@workstation" k3s_token = "generate-with: openssl rand -hex 32"