#!/sbin/openrc-run
# K3s server control plane. v1 = single-node embedded SQLite (kine) datastore;
# the per-cluster config.yaml omits cluster-init so k3s uses SQLite, not etcd
# (etcd's per-commit fsync stalls on the viperblock root volume). Data lives at
# /var/lib/rancher/k3s; subsequent starts reuse it. Multi-server HA needs etcd
# and is deferred.

description="K3s Kubernetes server (Mulga EKS control plane)"
command="/usr/local/bin/k3s"
command_args="server --config /etc/rancher/k3s/config.yaml"
command_background="yes"
pidfile="/run/k3s.pid"
output_log="/var/log/k3s.log"
error_log="/var/log/k3s.log"

# Generous start timeout — K3s bootstraps containerd, initialises the SQLite
# datastore, pulls system images. First boot can take 2-3 minutes on cold cache.
start_stop_daemon_args="--wait 5000"

depend() {
    need net cgroups
    after firewall
}

start_pre() {
    # config.yaml is written by k3s-first-boot from the skeleton + cloud-init
    # data. Refuse to start if neither exists.
    if [ ! -f /etc/rancher/k3s/config.yaml ]; then
        if [ -f /etc/rancher/k3s/config.yaml.skel ]; then
            cp /etc/rancher/k3s/config.yaml.skel /etc/rancher/k3s/config.yaml
        else
            eerror "no /etc/rancher/k3s/config.yaml and no .skel to derive from"
            return 1
        fi
    fi

    # The apiserver is configured with --authentication-token-webhook-config-file
    # pointing at the kubeconfig eks-token-webhook writes at startup. `before k3s`
    # orders the webhook's start but it backgrounds, so wait (bounded) for the
    # kubeconfig to land before letting the apiserver load a missing file.
    i=0
    while [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ] && [ "${i}" -lt 30 ]; do
        sleep 1
        i=$((i + 1))
    done
    if [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ]; then
        ewarn "eks-token-webhook kubeconfig absent after ${i}s; IAM token auth will be unavailable until the webhook starts"
    fi
}