control_plane.bu.mustache

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.

variant: fcos
version: 1.5.0

passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - {{ssh_authorized_key}}

storage:
  files:
    - path: /etc/otelcol-contrib/config.yaml
      contents:
        local: files/otelcol.yaml
      mode: 0644
    - path: /etc/rancher/k3s/config.yaml
      contents:
        local: files/k3s-config.yaml
      mode: 0600
    - path: /etc/rancher/k3s/tls/server-ca.crt
      contents:
        local: certs/server-ca.crt
      mode: 0644
    - path: /etc/rancher/k3s/tls/server-ca.key
      contents:
        local: certs/server-ca.key
      mode: 0600
    - path: /etc/rancher/k3s/tls/client-ca.crt
      contents:
        local: certs/client-ca.crt
      mode: 0644
    - path: /etc/rancher/k3s/tls/client-ca.key
      contents:
        local: certs/client-ca.key
      mode: 0600
    - path: /usr/local/bin/configure-vpc.sh
      mode: 0755
      contents:
        local: files/configure-vpc.sh
    - path: /usr/local/bin/k3s-init.sh
      mode: 0755
      contents:
        local: files/k3s-init.sh
    - path: /etc/rancher/k3s/manifests/fleetlock.yaml
      contents:
        local: files/fleetlock.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/traefik-config.yaml
      contents:
        local: files/traefik-config.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/external-dns.yaml
      contents:
        local: files/external-dns.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/vultr-dns-secret.yaml
      contents:
        local: files/vultr-dns-secret.yaml
      mode: 0600
    - path: /etc/rancher/k3s/manifests/vultr-csi-secret.yaml
      contents:
        local: files/vultr-csi-secret.yaml
      mode: 0600
    - path: /etc/rancher/k3s/manifests/vultr-csi.yaml
      contents:
        local: vendor/vultr-csi/v0.17.1.yml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/cert-manager.yaml
      contents:
        local: files/cert-manager.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/cert-manager-webhook-vultr.yaml
      contents:
        local: files/cert-manager-webhook-vultr.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/cluster-issuer.yaml
      contents:
        local: files/cluster-issuer.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/keel.yaml
      contents:
        local: files/keel.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/otelcol-k8s.yaml
      contents:
        local: files/otelcol-k8s.yaml
      mode: 0600
    - path: /usr/local/bin/upgrade-os.sh
      mode: 0755
      contents:
        local: files/upgrade-os.sh
    - path: /usr/local/bin/fleetlock-release.sh
      mode: 0755
      contents:
        local: files/fleetlock-release.sh
    - path: /var/lib/.fresh-deploy
      mode: 0644
      contents:
        inline: ""
    - path: /etc/rancher/k3s/manifests/agent-cleanup-rbac.yaml
      contents:
        local: files/agent-cleanup-rbac.yaml
      mode: 0644
    - path: /etc/rancher/k3s/manifests/coredns-autoscaler.yaml
      contents:
        local: files/coredns-autoscaler.yaml
      mode: 0644
    - path: /usr/local/bin/rebase-os.sh
      mode: 0755
      contents:
        local: files/rebase-os.sh
    - path: /usr/local/bin/enforce-taint.sh
      mode: 0755
      contents:
        local: files/enforce-taint.sh

systemd:
  units:
    - name: rebase-os.service
      enabled: true
      contents: |
        [Unit]
        Description=Rebase to custom FCOS image
        After=network-online.target
        Requires=network-online.target

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/local/bin/rebase-os.sh

        [Install]
        WantedBy=multi-user.target

    - name: otelcol-contrib.service
      enabled: true
      contents: |
        [Unit]
        Description=OpenTelemetry Collector Contrib
        After=rebase-os.service network-online.target
        Requires=rebase-os.service

        [Service]
        ExecStart=/usr/bin/otelcol-contrib --config /etc/otelcol-contrib/config.yaml
        Restart=always
        RestartSec=5

        [Install]
        WantedBy=multi-user.target

    - name: configure-vpc.service
      enabled: true
      contents: |
        [Unit]
        Description=Configure VPC network interface from Vultr metadata
        After=network-online.target
        Requires=network-online.target

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/local/bin/configure-vpc.sh 10.0.0.3

        [Install]
        WantedBy=multi-user.target

    - name: k3s-init.service
      enabled: true
      contents: |
        [Unit]
        Description=Initialize k3s (IP detection, TLS cert management)
        After=rebase-os.service var-lib-rancher-k3s.mount configure-vpc.service network-online.target
        Requires=rebase-os.service var-lib-rancher-k3s.mount configure-vpc.service

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/local/bin/k3s-init.sh

        [Install]
        WantedBy=multi-user.target

    - name: k3s.service
      enabled: true
      contents: |
        [Unit]
        Description=k3s control plane
        After=k3s-init.service network-online.target
        Requires=k3s-init.service

        [Service]
        ExecStart=/usr/bin/k3s server
        Restart=always
        RestartSec=5

        [Install]
        WantedBy=multi-user.target

    - name: upgrade-os.service
      enabled: false
      contents: |
        [Unit]
        Description=Check for and apply OS image upgrades
        After=network-online.target
        Requires=network-online.target
        ConditionPathExists=/var/lib/.rebase-complete

        [Service]
        Type=oneshot
        ExecStart=/usr/local/bin/upgrade-os.sh

    - name: upgrade-os.timer
      enabled: true
      contents: |
        [Unit]
        Description=Periodic OS image upgrade check

        [Timer]
        OnBootSec=5min
        OnUnitActiveSec=6h
        RandomizedDelaySec=30min

        [Install]
        WantedBy=timers.target

    - name: enforce-taint.service
      enabled: true
      contents: |
        [Unit]
        Description=Enforce control-plane taint
        After=k3s.service
        Requires=k3s.service

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/local/bin/enforce-taint.sh

        [Install]
        WantedBy=multi-user.target

    - name: fleetlock-release.service
      enabled: true
      contents: |
        [Unit]
        Description=Release FleetLock after reboot
        After=network-online.target k3s.service
        Requires=network-online.target

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/usr/local/bin/fleetlock-release.sh

        [Install]
        WantedBy=multi-user.target

    - name: format-vdb.service
      enabled: true
      contents: |
        [Unit]
        Description=Partition /dev/vdb if needed
        DefaultDependencies=no
        After=dev-vdb.device
        Before=local-fs.target

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/bin/bash -c 'blkid /dev/vdb | grep -q TYPE || sgdisk -Z -n 1:0:0 -t 1:8300 /dev/vdb'

        [Install]
        WantedBy=multi-user.target

    - name: mkfs-vdb1.service
      enabled: true
      contents: |
        [Unit]
        Description=Format /dev/vdb1 if needed
        DefaultDependencies=no
        After=dev-vdb1.device format-vdb.service
        Before=local-fs.target

        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=/bin/bash -c 'blkid /dev/vdb1 | grep -q TYPE || mkfs.ext4 /dev/vdb1'

        [Install]
        WantedBy=multi-user.target

    - name: var-lib-rancher-k3s.mount
      enabled: true
      contents: |
        [Unit]
        Description=Mount k3s data volume
        After=mkfs-vdb1.service
        Requires=mkfs-vdb1.service

        [Mount]
        What=/dev/vdb1
        Where=/var/lib/rancher/k3s
        Type=ext4

        [Install]
        WantedBy=multi-user.target