#!/sbin/openrc-run
# K3s server control plane. The per-cluster config.yaml sets cluster-init, so
# k3s uses the embedded etcd datastore (required for multi-server HA). Data
# lives at /var/lib/rancher/k3s; subsequent starts reuse it.

description="K3s Kubernetes server (Mulga EKS control plane)"
command="/usr/local/bin/k3s"
command_args="server --config /etc/rancher/k3s/config.yaml"
command_background="yes"
pidfile="/run/k3s.pid"
output_log="/var/log/k3s.log"
error_log="/var/log/k3s.log"

# Generous start timeout — K3s bootstraps containerd, initialises the embedded
# etcd datastore, pulls system images. First boot can take 2-3 minutes on cold cache.
start_stop_daemon_args="--wait 5000"

depend() {
    need net cgroups
    after firewall
}

start_pre() {
    # config.yaml is written by k3s-first-boot from the skeleton + cloud-init
    # data. Refuse to start if neither exists.
    if [ ! -f /etc/rancher/k3s/config.yaml ]; then
        if [ -f /etc/rancher/k3s/config.yaml.skel ]; then
            cp /etc/rancher/k3s/config.yaml.skel /etc/rancher/k3s/config.yaml
        else
            eerror "no /etc/rancher/k3s/config.yaml and no .skel to derive from"
            return 1
        fi
    fi

    # The apiserver is configured with --authentication-token-webhook-config-file
    # pointing at the kubeconfig eks-token-webhook writes at startup. `before k3s`
    # orders the webhook's start but it backgrounds, so wait (bounded) for the
    # kubeconfig to land before letting the apiserver load a missing file.
    i=0
    while [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ] && [ "${i}" -lt 30 ]; do
        sleep 1
        i=$((i + 1))
    done
    if [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ]; then
        ewarn "eks-token-webhook kubeconfig absent after ${i}s; IAM token auth will be unavailable until the webhook starts"
    fi
}