* feat: make the server config file mode configurable
/etc/rancher/k3s/config.yaml holds the cluster token. The server and
upgrade roles write it at 0644, so every local account on a server node
can read the credential that joins a node to the cluster.
k3s_server_config_mode sets the mode of that file in both roles. It
defaults to 0644, so behaviour is unchanged unless it is set.
Signed-off-by: Kristofer <kristofer@atlascloud.is>
* docs: describe the server config file contents accurately
/etc/rancher/k3s/config.yaml does not always carry the cluster token. A
first server that lets K3s generate one writes the file without it, so the
file can contain the token rather than always holding it. Correct that
claim in the README, the inventory sample and the role default, and use
the US spelling of "honors".
Signed-off-by: Kristofer <kristofer@atlascloud.is>
* Name the floor the config file mode can be narrowed to
Saying any mode root can read works leaves the reader to work out what
that means in practice. The file is read only by k3s, running as root, so
0600 is the tightest mode that still works.
Signed-off-by: Kristofer <kristofer@atlascloud.is>
* Run the basic integration job with a non-default config file mode
The templated mode was only ever rendered with its default in CI, which
is the one value that cannot tell a working template from a broken one.
The basic inventory sets 0640 and the job reads the mode back off the
installed file.
Signed-off-by: Kristofer <kristofer@atlascloud.is>
---------
Signed-off-by: Kristofer <kristofer@atlascloud.is>
Re-running site.yml with a raised k3s_version replaced the on-disk
binary but left agents and joined servers running the old runtime,
because the install script skips the service start and the roles only
restarted the service on a config change. A version-only bump was
therefore not applied until the services were restarted by hand.
Always restart the k3s service in the server and agent roles on a
site.yml run, so the cluster reliably picks up a new config or runtime
without any logic to detect whether the binary changed. On a
multi-server cluster, run the playbook with --forks=1 so the servers
restart one at a time and the etcd quorum is preserved; document this
in the README.
Keep the dedicated upgrade.yml integration test and add a second
upgrade through site.yml, asserting the running version the kubelet
reports rather than the on-disk binary, so the tests fail if the
restart regresses.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
* fix: handle Oracle Linux UEK kernel package name for br_netfilter
Oracle Linux uses the Unbreakable Enterprise Kernel (UEK) instead of the
standard RHEL kernel. The `kernel-modules-extra` package does not exist
on Oracle Linux — the equivalent is `kernel-uek-modules-extra`.
Without this fix, the prereq role fails on Oracle Linux 10 with:
"No package kernel-modules-extra available."
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
* chore: update README to include Oracle Linux
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
---------
Signed-off-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
Co-authored-by: Helmut Wolf <3902045+shadow1runner@users.noreply.github.com>
* Initial airgap support
* Support any of the compressed image formats
* Add airgap section to README
* Support Airgap SElinux RPM install
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Add mention of other projects
* Add gitattributes to fix language reporting in GH
* Add debug playbook to gitignore
* Add more info around what this project will not cover
* Remove construction label, reword
Signed-off-by: Derek Nola <derek.nola@suse.com>
- K3s has some absolute paths set in various places which cannot be
changed. Using a symbolic link was the easiest fix. This is nice for
running K3S on SBC that must boot to SD but K3S data should be stored
on a faster drive.
- Other changes are for making the site playbook replayable without
resetting the cluster. Ideally you can rerun it to check existing
nodes or to add new ones.
Signed-off-by: Derek Nola <derek.nola@suse.com>
- HA option for multiple server nodes using embedded etcd
- Switch to yaml inventory file for easier editing and combining vars
- Update to full ansible module names
- Change master/node names to server/agent
- Cleanup small linting errors
- Add reboot playbook which staggers reboot to keep HA cluster up
- Move playbooks to playbook directory
Signed-off-by: Derek Nola <derek.nola@suse.com>
There are some issues and quirks in the markdown documentation files
suggested by the markdownlint project checker that might benefit from
being fixed, which this patch does.
Change-Id: I33245825e5bb543b5ce1732204984d4a0b169668
Signed-off-by: Joakim Roubert <joakimr@axis.com>
- Setting IPv4 & IPv6 forwarding
- Setting `sysctl:net.bridge.bridge-nf-call-iptables` and `bridge-nf-call-ip6tables` to enabled since it is disabled by default on some CentOS systems
Kris
Stéphane Este-Gracias
Aleksei Sviridkin
Rémi Paulmier
shadow1runnerandHelmut Wolf
Derek Nola
Ken Powers
Mörgæsis
Phillip Thurston
Felix Seifert
hek2mglandhek2mgl
Floren MunteanuandFloren Munteanu
Peter Klijn
Daniel Clavijo Coca
Assaf Sapir
Nicholas Malcolm
Zaher Ghaibeh
David Putzolu
Jeff Geerling
Ahmed Sallam
Joakim Roubert
Julien DOCHE
Matthias Riegler
Ted Wexler
Vincent RABAH