jakman85andClaude Opus 4.8
39123d7806
bpg/proxmox generates cloud-init network-config (static IP/gw/DNS) and meta-data natively from the VM initialization block, so remove network-config.yaml.tftpl and meta-data.yaml.tftpl. The rich first-boot baseline (users, SSH key, packages, kernel modules, Longhorn /dev/vdb mount, swap-off) is preserved and shipped as a user-data snippet referenced by initialization.user_data_file_id. Comments updated (libvirt -> Proxmox); /dev/vdb still valid (data disk is virtio1). Co-Authored-By: Claude Opus 4.8 <[email protected]>
76 lines
2.5 KiB
Plaintext
76 lines
2.5 KiB
Plaintext
#cloud-config
|
|
# user-data — first-boot BASELINE only (docs/02 stage 2 "Baseline"). Rendered by
|
|
# OpenTofu templatefile() ($${...} = tofu vars, NOT cloud-init). Everything here is
|
|
# the node prerequisite floor for k3s / Cilium / Longhorn / KubeVirt. Cluster join,
|
|
# k3s, and Cilium install are ANSIBLE's job (T-1.3) — deliberately NOT done here.
|
|
|
|
hostname: ${hostname}
|
|
fqdn: ${fqdn}
|
|
preserve_hostname: false
|
|
|
|
# Login user (also the Ansible ansible_user). Public key only — no passwords.
|
|
users:
|
|
- name: ${username}
|
|
groups: [sudo]
|
|
shell: /bin/bash
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
lock_passwd: true
|
|
ssh_authorized_keys:
|
|
- ${ssh_authorized_key}
|
|
|
|
# Baseline packages: guest agent (tofu/Proxmox), and Longhorn's node prerequisites
|
|
# (open-iscsi provides iscsid + iscsiadm; nfs-common provides the NFS client).
|
|
package_update: true
|
|
packages:
|
|
- qemu-guest-agent
|
|
- open-iscsi
|
|
- nfs-common
|
|
- curl
|
|
|
|
# Kernel modules required by Cilium (overlay, br_netfilter) and Longhorn
|
|
# (iscsi_tcp, dm_crypt, nfs). Loaded now and persisted for reboots.
|
|
write_files:
|
|
- path: /etc/modules-load.d/k3s-cilium-longhorn.conf
|
|
permissions: "0644"
|
|
content: |
|
|
overlay
|
|
br_netfilter
|
|
iscsi_tcp
|
|
dm_crypt
|
|
nfs
|
|
- path: /etc/sysctl.d/99-k3s-cilium.conf
|
|
permissions: "0644"
|
|
content: |
|
|
net.bridge.bridge-nf-call-iptables = 1
|
|
net.bridge.bridge-nf-call-ip6tables = 1
|
|
net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1
|
|
fs.inotify.max_user_instances = 8192
|
|
fs.inotify.max_user_watches = 524288
|
|
|
|
# Dedicated Longhorn data disk (/dev/vdb, the VM's virtio1 disk) → ext4 mounted at
|
|
# /var/lib/longhorn. nofail so a node still boots if the disk is absent during a rebuild.
|
|
fs_setup:
|
|
- label: longhorn
|
|
filesystem: ext4
|
|
device: /dev/vdb
|
|
partition: none
|
|
overwrite: false
|
|
mounts:
|
|
- ["LABEL=longhorn", "/var/lib/longhorn", "ext4", "defaults,nofail,x-systemd.device-timeout=5s", "0", "2"]
|
|
|
|
runcmd:
|
|
# Apply modules + sysctls now (cloud-init runs after they're written).
|
|
- ["modprobe", "overlay"]
|
|
- ["modprobe", "br_netfilter"]
|
|
- ["modprobe", "iscsi_tcp"]
|
|
- ["sysctl", "--system"]
|
|
# Longhorn needs iscsid running; guest agent for Proxmox/tofu.
|
|
- ["systemctl", "enable", "--now", "iscsid"]
|
|
- ["systemctl", "enable", "--now", "qemu-guest-agent"]
|
|
# k3s/kubelet baseline: disable swap.
|
|
- ["swapoff", "-a"]
|
|
- ["sed", "-i", "/\\sswap\\s/d", "/etc/fstab"]
|
|
|
|
# NOTE: no reboot here — the baseline is live after runcmd. Ansible connects next.
|