jakman85andClaude Opus 4.8
f2a7e42068
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
76 lines
2.5 KiB
Plaintext
76 lines
2.5 KiB
Plaintext
#cloud-config
|
|
# user-data — first-boot BASELINE only (docs/02 stage 2 "Baseline"). Rendered by
|
|
# OpenTofu templatefile() ($${...} = tofu vars, NOT cloud-init). Everything here is
|
|
# the node prerequisite floor for k3s / Cilium / Longhorn / KubeVirt. Cluster join,
|
|
# k3s, and Cilium install are ANSIBLE's job (T-1.3) — deliberately NOT done here.
|
|
|
|
hostname: ${hostname}
|
|
fqdn: ${fqdn}
|
|
preserve_hostname: false
|
|
|
|
# Login user (also the Ansible ansible_user). Public key only — no passwords.
|
|
users:
|
|
- name: ${username}
|
|
groups: [sudo]
|
|
shell: /bin/bash
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
lock_passwd: true
|
|
ssh_authorized_keys:
|
|
- ${ssh_authorized_key}
|
|
|
|
# Baseline packages: guest agent (tofu/libvirt), and Longhorn's node prerequisites
|
|
# (open-iscsi provides iscsid + iscsiadm; nfs-common provides the NFS client).
|
|
package_update: true
|
|
packages:
|
|
- qemu-guest-agent
|
|
- open-iscsi
|
|
- nfs-common
|
|
- curl
|
|
|
|
# Kernel modules required by Cilium (overlay, br_netfilter) and Longhorn
|
|
# (iscsi_tcp, dm_crypt, nfs). Loaded now and persisted for reboots.
|
|
write_files:
|
|
- path: /etc/modules-load.d/k3s-cilium-longhorn.conf
|
|
permissions: "0644"
|
|
content: |
|
|
overlay
|
|
br_netfilter
|
|
iscsi_tcp
|
|
dm_crypt
|
|
nfs
|
|
- path: /etc/sysctl.d/99-k3s-cilium.conf
|
|
permissions: "0644"
|
|
content: |
|
|
net.bridge.bridge-nf-call-iptables = 1
|
|
net.bridge.bridge-nf-call-ip6tables = 1
|
|
net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1
|
|
fs.inotify.max_user_instances = 8192
|
|
fs.inotify.max_user_watches = 524288
|
|
|
|
# Dedicated Longhorn data disk (/dev/vdb) → ext4 mounted at /var/lib/longhorn.
|
|
# nofail so a node still boots if the disk is absent during a rebuild.
|
|
fs_setup:
|
|
- label: longhorn
|
|
filesystem: ext4
|
|
device: /dev/vdb
|
|
partition: none
|
|
overwrite: false
|
|
mounts:
|
|
- ["LABEL=longhorn", "/var/lib/longhorn", "ext4", "defaults,nofail,x-systemd.device-timeout=5s", "0", "2"]
|
|
|
|
runcmd:
|
|
# Apply modules + sysctls now (cloud-init runs after they're written).
|
|
- ["modprobe", "overlay"]
|
|
- ["modprobe", "br_netfilter"]
|
|
- ["modprobe", "iscsi_tcp"]
|
|
- ["sysctl", "--system"]
|
|
# Longhorn needs iscsid running; guest agent for libvirt/tofu.
|
|
- ["systemctl", "enable", "--now", "iscsid"]
|
|
- ["systemctl", "enable", "--now", "qemu-guest-agent"]
|
|
# k3s/kubelet baseline: disable swap.
|
|
- ["swapoff", "-a"]
|
|
- ["sed", "-i", "/\\sswap\\s/d", "/etc/fstab"]
|
|
|
|
# NOTE: no reboot here — the baseline is live after runcmd. Ansible connects next.
|