mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
66 lines
2.9 KiB
Plaintext
Executable File
66 lines
2.9 KiB
Plaintext
Executable File
#!/sbin/openrc-run
|
|
# K3s server control plane. The per-cluster config.yaml sets cluster-init, so
|
|
# k3s uses the embedded etcd datastore (required for multi-server HA). Data
|
|
# lives at /var/lib/rancher/k3s; subsequent starts reuse it.
|
|
|
|
description="K3s Kubernetes server (Mulga EKS control plane)"
|
|
command="/usr/local/bin/k3s"
|
|
command_args="server --config /etc/rancher/k3s/config.yaml"
|
|
pidfile="/run/k3s.pid"
|
|
|
|
# Supervise the apiserver. A transient k3s crash must self-heal: without a
|
|
# supervisor a single exit leaves the control plane permanently dead, the NLB
|
|
# target never recovers, and the cluster wedges ACTIVE-but-unreachable.
|
|
supervisor="supervise-daemon"
|
|
respawn_delay=5
|
|
respawn_max=0
|
|
output_log="/var/log/k3s.log"
|
|
error_log="/var/log/k3s.log"
|
|
|
|
depend() {
|
|
need net cgroups
|
|
after firewall
|
|
}
|
|
|
|
start_pre() {
|
|
# config.yaml is written by k3s-first-boot from the skeleton + cloud-init
|
|
# data. Refuse to start if neither exists.
|
|
if [ ! -f /etc/rancher/k3s/config.yaml ]; then
|
|
if [ -f /etc/rancher/k3s/config.yaml.skel ]; then
|
|
cp /etc/rancher/k3s/config.yaml.skel /etc/rancher/k3s/config.yaml
|
|
else
|
|
eerror "no /etc/rancher/k3s/config.yaml and no .skel to derive from"
|
|
return 1
|
|
fi
|
|
fi
|
|
|
|
# Deferred built-in ingress: when this cluster wants traefik
|
|
# (EKS_DEFER_TRAEFIK=1) but the control plane has not yet stabilised (no
|
|
# traefik-enabled sentinel), stage a deploy-controller .skip marker so k3s
|
|
# writes traefik.yaml/traefik-crd.yaml but does NOT apply them. Staged here,
|
|
# pre-start, so the marker exists before the deploy controller first scans —
|
|
# racing it post-start could apply traefik (and crash etcd) anyway.
|
|
# mulga-eks-state-report removes the marker once the apiserver is healthy.
|
|
if [ -f /etc/spinifex-eks/first-boot.env ]; then
|
|
defer=$(. /etc/spinifex-eks/first-boot.env 2>/dev/null; echo "${EKS_DEFER_TRAEFIK:-0}")
|
|
if [ "${defer}" = "1" ] && [ ! -f /var/lib/spinifex-eks/traefik-enabled ]; then
|
|
mkdir -p /var/lib/rancher/k3s/server/manifests
|
|
: > /var/lib/rancher/k3s/server/manifests/traefik.yaml.skip
|
|
: > /var/lib/rancher/k3s/server/manifests/traefik-crd.yaml.skip
|
|
fi
|
|
fi
|
|
|
|
# The apiserver is configured with --authentication-token-webhook-config-file
|
|
# pointing at the kubeconfig eks-token-webhook writes at startup. `before k3s`
|
|
# orders the webhook's start but it backgrounds, so wait (bounded) for the
|
|
# kubeconfig to land before letting the apiserver load a missing file.
|
|
i=0
|
|
while [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ] && [ "${i}" -lt 30 ]; do
|
|
sleep 1
|
|
i=$((i + 1))
|
|
done
|
|
if [ ! -f /etc/spinifex-eks/token-webhook.kubeconfig ]; then
|
|
ewarn "eks-token-webhook kubeconfig absent after ${i}s; IAM token auth will be unavailable until the webhook starts"
|
|
fi
|
|
}
|