deytenit
502ef94bb2
### Summary of Changes This PR incorporates the final infrastructure optimizations following the initial merge of PR #25: 1. **SOPS & Secrets Management**: - Generated dedicated Age keypair (`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and updated `.sops.yaml`. - Added SOPS-encrypted production secrets for PostgreSQL (`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics (`ci/k8s/apps/umami/secret.sops.yaml`). - Verified 100% clean round-trip decryption. 2. **Cloud-Init Template & Git Safety**: - Converted `user-data.yaml` into `user-data.template.yaml` with clear stubs for public SSH keys and private Age keys. - Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent accidental secret leaks. 3. **Persistent Secondary Storage**: - Added automated detection, ext4 formatting, and mounting of secondary persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with `noatime` in `user-data.template.yaml`. 4. **Golden Image Naming & Workflows**: - Updated image naming convention to include hyphenated UTC timestamps: `com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`. - Verified successful CI golden image build and S3 upload.
26 lines
659 B
Bash
Executable File
26 lines
659 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eu
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
echo "=== Installing K3s Binary (First-Boot Isolation) ==="
|
|
|
|
export INSTALL_K3S_SKIP_ENABLE="true"
|
|
export INSTALL_K3S_SKIP_START="true"
|
|
export INSTALL_K3S_VERSION="v1.31.2+k3s1"
|
|
|
|
# Download official K3s installer and install binary/systemd unit without starting
|
|
curl -sfL https://get.k3s.io | sh -
|
|
|
|
# Verify k3s binary is located in /usr/local/bin
|
|
which k3s
|
|
k3s --version
|
|
|
|
# Ensure systemd service is NOT running
|
|
systemctl stop k3s.service || true
|
|
systemctl disable k3s.service || true
|
|
|
|
# Create configuration directory
|
|
mkdir -p /etc/rancher/k3s
|
|
|
|
echo "=== K3s Pre-installation Complete ==="
|