spinifex/scripts/images/eks-node/k3s.initd

#!/sbin/openrc-run
# K3s server control plane. The per-cluster config.yaml sets cluster-init, so
# k3s uses the embedded etcd datastore (required for multi-server HA). Data
# lives at /var/lib/rancher/k3s; subsequent starts reuse it.

description="K3s Kubernetes server (Mulga EKS control plane)"
command="/usr/local/bin/k3s"
command_args="server --config /etc/rancher/k3s/config.yaml"
pidfile="/run/k3s.pid"

# Supervise the apiserver. A transient k3s crash must self-heal: without a
# supervisor a single exit leaves the control plane permanently dead, the NLB
# target never recovers, and the cluster wedges ACTIVE-but-unreachable.
supervisor="supervise-daemon"
respawn_delay=5
respawn_max=0
output_log="/var/log/k3s.log"
error_log="/var/log/k3s.log"

depend() {
    need net cgroups
    after firewall
}

start_pre() {
    # config.yaml is written by k3s-first-boot from the skeleton + cloud-init
    # data. Refuse to start if neither exists.
    if [ ! -f /etc/rancher/k3s/config.yaml ]; then
        if [ -f /etc/rancher/k3s/config.yaml.skel ]; then
            cp /etc/rancher/k3s/config.yaml.skel /etc/rancher/k3s/config.yaml
        else
            eerror "no /etc/rancher/k3s/config.yaml and no .skel to derive from"
            return 1
        fi
    fi

    # Deferred built-in ingress: when this cluster wants traefik
    # (EKS_DEFER_TRAEFIK=1) but the control plane has not yet stabilised (no
    # traefik-enabled sentinel), stage a deploy-controller .skip marker so k3s
    # writes traefik.yaml/traefik-crd.yaml but does NOT apply them. Staged here,
    # pre-start, so the marker exists before the deploy controller first scans —
    # racing it post-start could apply traefik (and crash etcd) anyway.
    # mulga-eks-state-report removes the marker once the apiserver is healthy.
    if [ -f /etc/spinifex-eks/first-boot.env ]; then
        defer=$(. /etc/spinifex-eks/first-boot.env 2>/dev/null; echo "${EKS_DEFER_TRAEFIK:-0}")
        if [ "${defer}" = "1" ] && [ ! -f /var/lib/spinifex-eks/traefik-enabled ]; then
            mkdir -p /var/lib/rancher/k3s/server/manifests
            : > /var/lib/rancher/k3s/server/manifests/traefik.yaml.skip
            : > /var/lib/rancher/k3s/server/manifests/traefik-crd.yaml.skip
        fi
    fi

    # Node-local CoreDNS: suppress k3s's bundled CoreDNS (a single Deployment that
    # tolerates the CP taint and strands itself on the control-plane node) and
    # deploy the Mulga DaemonSet variant so every node resolves via its own
    # CoreDNS. Worker pods cannot reach a CP-resident CoreDNS — the worker<->CP
    # overlay does not cross the VPC boundary. Staged pre-start so the deploy
    # controller never applies the bundled manifest. Guarded on the baked bundle:
    # an older image without it keeps k3s's CoreDNS rather than losing DNS.
    if [ -f /usr/share/spinifex-eks/coredns/coredns-mulga.yaml ]; then
        mkdir -p /var/lib/rancher/k3s/server/manifests
        : > /var/lib/rancher/k3s/server/manifests/coredns.yaml.skip
        cp /usr/share/spinifex-eks/coredns/coredns-mulga.yaml \
            /var/lib/rancher/k3s/server/manifests/coredns-mulga.yaml
    fi

    # The apiserver is configured with --authentication-token-webhook-config-file
    # pointing at the kubeconfig eks-token-webhook writes at startup. `before k3s`
    # orders the webhook's start but it backgrounds, so wait (bounded) for the
    # kubeconfig to land before letting the apiserver load a missing file.
    i=0
    while [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ] && [ "${i}" -lt 30 ]; do
        sleep 1
        i=$((i + 1))
    done
    if [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ]; then
        ewarn "eks-token-webhook kubeconfig absent after ${i}s; IAM token auth will be unavailable until the webhook starts"
    fi
}