mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
f14fb64562
* feat(eks): unify eks-server + eks-agent into one eks-node AMI Collapse the two K3s AMIs into a single spinifex-eks-node image whose role (server vs agent) is chosen per-instance at first boot, halving build time, storage, and CVE-rotation surface. - scripts/images/eks-node/: superset manifest + merged setup.sh; all role services baked but only crond + the new eks-node-role selector enabled. - eks-node-role first-boot selector reads SPINIFEX_K3S_ROLE, rc-update adds + starts the matching services (server: k3s + eks-token-webhook + k3s-first-boot publisher; agent: k3s-agent), records /etc/spinifex-eks/role, self-disables. Paths are env-overridable; eks-node-role_test.sh covers all five cases. - mulga-eks-etcd-snapshot.sh early-exits on agent nodes. - k3s_server_vm.go seeds SPINIFEX_K3S_ROLE=server into first-boot.env. - Makefile/dev-install: build-eks-node-image / import-eks-node-image replace the server+agent targets. - Delete scripts/images/eks-server + eks-agent. The launcher resolves the AMI by the spinifex:managed-by=eks tag, so running clusters (which hold the resolved AMI ID) are unaffected. AMI bake + cluster boot are operational integration steps, not yet run. * fix(eks): order eks-node-role after cloud-config/cloud-final The first-boot role selector reads /etc/spinifex-eks/first-boot.env, which cloud-init delivers via write_files in the cloud-config/cloud-final stages. The selector only depended on net+cgroups, so on a fast boot it could start before write_files landed and read a missing role env. Add an after-ordering on cloud-config + cloud-final so the env file is always present first.
28 lines
1.3 KiB
Plaintext
Executable File
28 lines
1.3 KiB
Plaintext
Executable File
#!/sbin/openrc-run
|
|
# eks-node-role — one-shot first-boot service that selects the node's role
|
|
# (server vs agent) from the cloud-init env and enables + starts the matching
|
|
# K3s services. The unified eks-node AMI bakes every role's services but leaves
|
|
# them out of the default runlevel; this selector adds the correct ones and then
|
|
# removes itself so it runs exactly once.
|
|
|
|
description="EKS node role selector (server vs agent)"
|
|
# Backgrounded: the selector calls `rc-service k3s start`, which blocks on k3s'
|
|
# start-stop-daemon --wait window; backgrounding keeps it off the runlevel's
|
|
# critical path. command_background is also required for output_log/error_log.
|
|
command="/usr/local/sbin/eks-node-role"
|
|
command_background="yes"
|
|
pidfile="/run/eks-node-role.pid"
|
|
# Route to the serial console so the role decision + any failure is visible in
|
|
# the orchestrator's host-side console capture — the VM has no operator login.
|
|
output_log="/dev/console"
|
|
error_log="/dev/console"
|
|
|
|
depend() {
|
|
# Needs the same substrate the role services do, since it starts them.
|
|
need net cgroups
|
|
# cloud-init write_files delivers /etc/spinifex-eks/first-boot.env (the role
|
|
# source) in the cloud-config/cloud-final stages. Order after them so the
|
|
# selector never races ahead and reads a missing env file on a fast boot.
|
|
after firewall cloud-config cloud-final
|
|
}
|