mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-19 10:52:04 +00:00
Josh Siviour
4d8a34b545
The nodegroup label was only written to K3S_NODE_LABEL in agent.env, but k3s has no such env var, so non-GPU workers never received the label. waitWorkersReady buckets Ready nodes by that label (added in #511), so the affected nodegroups never counted toward their ACTIVE transition and stayed CREATING until timeout. Ride the label on a real k3s node-label config drop-in (15-nodegroup-label.yaml), delivered via cloud-init user-data. Drop the inert K3S_NODE_LABEL from agent.env and the initd export.
62 lines
2.5 KiB
Plaintext
Executable File
62 lines
2.5 KiB
Plaintext
Executable File
#!/sbin/openrc-run
|
|
# K3s agent (worker node). Env vars K3S_URL + K3S_TOKEN come from cloud-init
|
|
# user-data — the orchestrator embeds them at RunInstances time per the
|
|
# Nodegroup bootstrap flow (eks-v1.md Q14).
|
|
#
|
|
# K3S_URL points at the cluster's NLB endpoint (https://{cluster}.{account}
|
|
# .eks.{region}.{suffix}:443) so the agent join path stays stable across the
|
|
# v2 HA migration (single-VM v1 → 3-node etcd quorum v2). No AMI rebuild
|
|
# needed when the control plane expands.
|
|
|
|
description="K3s Kubernetes agent (Mulga EKS worker)"
|
|
command="/usr/local/bin/k3s"
|
|
command_args="agent"
|
|
command_background="yes"
|
|
pidfile="/run/k3s-agent.pid"
|
|
output_log="/var/log/k3s-agent.log"
|
|
error_log="/var/log/k3s-agent.log"
|
|
|
|
start_stop_daemon_args="--wait 5000"
|
|
|
|
depend() {
|
|
need net cgroups
|
|
after firewall
|
|
}
|
|
|
|
start_pre() {
|
|
# Cloud-init drops these into /etc/spinifex-eks/agent.env. We source them
|
|
# here so OpenRC injects them into k3s' environment.
|
|
if [ -f /etc/spinifex-eks/agent.env ]; then
|
|
# shellcheck disable=SC1091
|
|
. /etc/spinifex-eks/agent.env
|
|
export K3S_URL K3S_TOKEN K3S_NODE_NAME
|
|
fi
|
|
if [ -z "${K3S_URL:-}" ] || [ -z "${K3S_TOKEN:-}" ]; then
|
|
eerror "K3S_URL and K3S_TOKEN must be set in /etc/spinifex-eks/agent.env"
|
|
return 1
|
|
fi
|
|
|
|
# Stamp the node providerID as aws:///<az>/<instance-id> (EKS parity) so the
|
|
# AWS Load Balancer Controller can resolve nodes as EC2 instances for ip-mode
|
|
# target registration; k3s' default k3s://<name> providerID makes it reject
|
|
# the node. Instance-id + AZ come from IMDSv2 (token-gated GET). On any miss
|
|
# we leave the default providerID rather than block the agent from starting.
|
|
_imds=http://169.254.169.254/latest
|
|
_curl="curl -fsS --connect-timeout 3 --max-time 5"
|
|
_tok=$(${_curl} -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 120' \
|
|
"${_imds}/api/token" 2>/dev/null)
|
|
if [ -n "${_tok}" ]; then
|
|
_iid=$(${_curl} -H "X-aws-ec2-metadata-token: ${_tok}" \
|
|
"${_imds}/meta-data/instance-id" 2>/dev/null)
|
|
_az=$(${_curl} -H "X-aws-ec2-metadata-token: ${_tok}" \
|
|
"${_imds}/meta-data/placement/availability-zone" 2>/dev/null)
|
|
if [ -n "${_iid}" ] && [ -n "${_az}" ]; then
|
|
command_args="agent --kubelet-arg=provider-id=aws:///${_az}/${_iid}"
|
|
else
|
|
ewarn "IMDS instance-id/az empty; keeping default providerID"
|
|
fi
|
|
else
|
|
ewarn "IMDS token request failed; keeping default providerID"
|
|
fi
|
|
}
|