mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-22 12:16:52 +00:00
Josh Siviour
f14fb64562
* feat(eks): unify eks-server + eks-agent into one eks-node AMI Collapse the two K3s AMIs into a single spinifex-eks-node image whose role (server vs agent) is chosen per-instance at first boot, halving build time, storage, and CVE-rotation surface. - scripts/images/eks-node/: superset manifest + merged setup.sh; all role services baked but only crond + the new eks-node-role selector enabled. - eks-node-role first-boot selector reads SPINIFEX_K3S_ROLE, rc-update adds + starts the matching services (server: k3s + eks-token-webhook + k3s-first-boot publisher; agent: k3s-agent), records /etc/spinifex-eks/role, self-disables. Paths are env-overridable; eks-node-role_test.sh covers all five cases. - mulga-eks-etcd-snapshot.sh early-exits on agent nodes. - k3s_server_vm.go seeds SPINIFEX_K3S_ROLE=server into first-boot.env. - Makefile/dev-install: build-eks-node-image / import-eks-node-image replace the server+agent targets. - Delete scripts/images/eks-server + eks-agent. The launcher resolves the AMI by the spinifex:managed-by=eks tag, so running clusters (which hold the resolved AMI ID) are unaffected. AMI bake + cluster boot are operational integration steps, not yet run. * fix(eks): order eks-node-role after cloud-config/cloud-final The first-boot role selector reads /etc/spinifex-eks/first-boot.env, which cloud-init delivers via write_files in the cloud-config/cloud-final stages. The selector only depended on net+cgroups, so on a fast boot it could start before write_files landed and read a missing role env. Add an after-ordering on cloud-config + cloud-final so the env file is always present first.
45 lines
2.3 KiB
Plaintext
45 lines
2.3 KiB
Plaintext
IMAGE_NAME="eks-node"
|
|
IMAGE_DESCRIPTION="Unified EKS K3s node VM — Alpine + K3s v1.32.5+k3s1 + eks-token-webhook; role (server|agent) chosen at first boot"
|
|
DISTRO="alpine"
|
|
ALPINE_VERSION="3.21.7"
|
|
|
|
# 4G — server superset (K3s server binary + SQLite datastore working set under
|
|
# /var/lib/rancher/k3s on the root disk). Agents use the same image; the ~10MB
|
|
# of unused server binary + webhook is dwarfed by the headroom for node images.
|
|
IMAGE_SIZE="4G"
|
|
|
|
# Server superset of both package sets (etcd-ctl is ~5MB, not worth branching).
|
|
# K3s pulls cgroups + iptables; nats-cli used by k3s-first-boot publisher +
|
|
# state-report; jq builds the bootstrap-message JSON envelopes; etcd-client
|
|
# used by the snapshot script (server role only).
|
|
APK_PACKAGES="ca-certificates curl jq iptables ip6tables conntrack-tools cgroup-tools etcd-ctl openrc"
|
|
|
|
# eks-token-webhook binary always installed (agents never start it). The k3s
|
|
# binary is downloaded + SHA256-verified by setup.sh (network in chroot).
|
|
BUILD_COMMANDS="CGO_ENABLED=0 go build -o bin/eks-token-webhook ./cmd/eks-token-webhook"
|
|
|
|
INSTALL_BINARIES="bin/eks-token-webhook:/usr/local/bin/eks-token-webhook"
|
|
|
|
# All role services ship; none but the selector are enabled at bake time.
|
|
# eks-node-role picks server vs agent at first boot and enables the rest.
|
|
INSTALL_FILES="\
|
|
scripts/images/eks-node/eks-node-role.initd:/etc/init.d/eks-node-role \
|
|
scripts/images/eks-node/eks-node-role.sh:/usr/local/sbin/eks-node-role \
|
|
scripts/images/eks-node/k3s.initd:/etc/init.d/k3s \
|
|
scripts/images/eks-node/k3s-agent.initd:/etc/init.d/k3s-agent \
|
|
scripts/images/eks-node/eks-token-webhook.initd:/etc/init.d/eks-token-webhook \
|
|
scripts/images/eks-node/k3s-first-boot.initd:/etc/init.d/k3s-first-boot \
|
|
scripts/images/eks-node/k3s-first-boot.sh:/usr/local/sbin/k3s-first-boot \
|
|
scripts/images/eks-node/mulga-eks-state-report.sh:/etc/periodic/15min/mulga-eks-state-report \
|
|
scripts/images/eks-node/mulga-eks-etcd-snapshot.sh:/etc/periodic/daily/mulga-eks-etcd-snapshot"
|
|
|
|
# Only crond (state-report) + the role selector at bake. The selector adds the
|
|
# role-specific services (k3s/eks-token-webhook/k3s-first-boot or k3s-agent) to
|
|
# the default runlevel on first boot.
|
|
ENABLE_SERVICES="crond eks-node-role"
|
|
|
|
SETUP_SCRIPT="scripts/images/eks-node/setup.sh"
|
|
|
|
AMI_NAME="spinifex-eks-node"
|
|
SYSTEM_TAG="spinifex:managed-by=eks"
|