Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS + 40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate = Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 01:21:00 -05:00
1 parent 224cd8ac35
commit f2a7e42068
@@ -0,0 +1,75 @@
+#cloud-config
+# user-data — first-boot BASELINE only (docs/02 stage 2 "Baseline"). Rendered by
+# OpenTofu templatefile() ($${...} = tofu vars, NOT cloud-init). Everything here is
+# the node prerequisite floor for k3s / Cilium / Longhorn / KubeVirt. Cluster join,
+# k3s, and Cilium install are ANSIBLE's job (T-1.3) — deliberately NOT done here.
+
+hostname: ${hostname}
+fqdn: ${fqdn}
+preserve_hostname: false
+
+# Login user (also the Ansible ansible_user). Public key only — no passwords.
+users:
+  - name: ${username}
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    lock_passwd: true
+    ssh_authorized_keys:
+      - ${ssh_authorized_key}
+
+# Baseline packages: guest agent (tofu/libvirt), and Longhorn's node prerequisites
+# (open-iscsi provides iscsid + iscsiadm; nfs-common provides the NFS client).
+package_update: true
+packages:
+  - qemu-guest-agent
+  - open-iscsi
+  - nfs-common
+  - curl
+
+# Kernel modules required by Cilium (overlay, br_netfilter) and Longhorn
+# (iscsi_tcp, dm_crypt, nfs). Loaded now and persisted for reboots.
+write_files:
+  - path: /etc/modules-load.d/k3s-cilium-longhorn.conf
+    permissions: "0644"
+    content: |
+      overlay
+      br_netfilter
+      iscsi_tcp
+      dm_crypt
+      nfs
+  - path: /etc/sysctl.d/99-k3s-cilium.conf
+    permissions: "0644"
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+      net.ipv6.conf.all.forwarding        = 1
+      fs.inotify.max_user_instances       = 8192
+      fs.inotify.max_user_watches         = 524288
+
+# Dedicated Longhorn data disk (/dev/vdb) → ext4 mounted at /var/lib/longhorn.
+# nofail so a node still boots if the disk is absent during a rebuild.
+fs_setup:
+  - label: longhorn
+    filesystem: ext4
+    device: /dev/vdb
+    partition: none
+    overwrite: false
+mounts:
+  - ["LABEL=longhorn", "/var/lib/longhorn", "ext4", "defaults,nofail,x-systemd.device-timeout=5s", "0", "2"]
+
+runcmd:
+  # Apply modules + sysctls now (cloud-init runs after they're written).
+  - ["modprobe", "overlay"]
+  - ["modprobe", "br_netfilter"]
+  - ["modprobe", "iscsi_tcp"]
+  - ["sysctl", "--system"]
+  # Longhorn needs iscsid running; guest agent for libvirt/tofu.
+  - ["systemctl", "enable", "--now", "iscsid"]
+  - ["systemctl", "enable", "--now", "qemu-guest-agent"]
+  # k3s/kubelet baseline: disable swap.
+  - ["swapoff", "-a"]
+  - ["sed", "-i", "/\\sswap\\s/d", "/etc/fstab"]
+
+# NOTE: no reboot here — the baseline is live after runcmd. Ansible connects next.