47 lines
1.7 KiB
Smarty
47 lines
1.7 KiB
Smarty
#cloud-config
|
|
hostname: ${hostname}
|
|
manage_etc_hosts: true
|
|
|
|
users:
|
|
- name: k3s
|
|
groups: sudo
|
|
shell: /bin/bash
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
ssh_authorized_keys:
|
|
- ${ssh_public_key}
|
|
|
|
package_update: true
|
|
packages:
|
|
- curl
|
|
|
|
# A script instead of a plain runcmd line for one reason: Terraform (see
|
|
# main.tf's closing comment) brings all VMs up in parallel, with no
|
|
# ordering guarantee that the server finishes installing k3s before an
|
|
# agent tries to join it. Baking the retry loop into a script keeps that
|
|
# concern out of runcmd, which just calls it once.
|
|
write_files:
|
|
- path: /usr/local/bin/join-k3s.sh
|
|
permissions: '0755'
|
|
content: |
|
|
#!/bin/sh
|
|
# Server may still be booting; retry the join until it answers.
|
|
# /ping is k3s's own unauthenticated liveness endpoint — this only
|
|
# confirms the API server is accepting connections yet, it's not a
|
|
# credential check (K3S_TOKEN below is what actually authorizes the
|
|
# join once it happens).
|
|
until curl -sk https://${server_ip}:6443/ping >/dev/null 2>&1; do
|
|
echo "waiting for k3s server at ${server_ip}..."
|
|
sleep 5
|
|
done
|
|
# Agents pass the token via environment variables to the installer
|
|
# rather than a config.yaml file (contrast server.yaml.tpl) because
|
|
# get.k3s.io's own install script reads K3S_URL/K3S_TOKEN directly
|
|
# for the "join an existing cluster" path — there's no separate
|
|
# agent config file it looks for the way the server has one.
|
|
curl -sfL https://get.k3s.io | \
|
|
K3S_URL="https://${server_ip}:6443" \
|
|
K3S_TOKEN="${k3s_token}" \
|
|
sh -s - agent
|
|
|
|
runcmd:
|
|
- /usr/local/bin/join-k3s.sh
|