mrcharles
e893fc80e9
Bootstrap a regular (non-ITAR) k3s cluster on cnode1/2/3 with embedded
etcd. All cluster communication — node registration, API server, etcd
peering, flannel VXLAN — runs exclusively over Tailscale IPs. Zero LAN
addresses appear in node status or TLS certificates.
Scripts (k8s/):
- env.sh: shared config (Tailscale IPs, SSH opts, k3s version)
- wipe.sh: remove existing k3s from all cnodes
- install-cp.sh: full bootstrap (cnode1 --cluster-init, then cnode2/3 join)
- join-servers.sh: re-join cnode2/3 only (fixes broken join state)
- post-setup.sh: apply NoSchedule taints, fetch kubeconfig, verify
- verify.sh: 13-point health check (nodes, Tailscale IPs, taints, etcd,
CoreDNS, API server, workload isolation)
- probe-nodes.sh: SSH + Tailscale reachability check
All 3 cnodes are tainted control-plane:NoSchedule so no user workloads
can schedule on the control plane. 13/13 health checks pass.
Docs updated: k8s README TL;DR reflects k3s (not Talos) as the deployed
choice, with Talos preserved for the future ITAR cluster.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
53 lines
1.6 KiB
Bash
53 lines
1.6 KiB
Bash
#!/usr/bin/bash
|
|
#
|
|
# k8s/wipe.sh — remove existing k3s from all cnodes
|
|
#
|
|
# The current install on cnode1/2 uses LAN IP (192.168.3.x). We need to
|
|
# rebuild with Tailscale IPs. This cluster has only system pods (16h old,
|
|
# no user workloads), so a clean wipe is safe.
|
|
#
|
|
set -uo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
# shellcheck source=./env.sh
|
|
source "$SCRIPT_DIR/env.sh"
|
|
|
|
echo "============================================"
|
|
echo " Wiping existing k3s from all cnodes"
|
|
echo "============================================"
|
|
|
|
for ip in "${ALL_CNODES[@]}"; do
|
|
echo ""
|
|
echo "--- $ip ---"
|
|
cn "$ip" '
|
|
# Stop services first
|
|
systemctl stop k3s 2>/dev/null || true
|
|
systemctl stop k3s-agent 2>/dev/null || true
|
|
|
|
# Server uninstall (also removes agents)
|
|
if [ -x /usr/local/bin/k3s-uninstall.sh ]; then
|
|
/usr/local/bin/k3s-uninstall.sh
|
|
elif [ -x /usr/local/bin/k3s-agent-uninstall.sh ]; then
|
|
/usr/local/bin/k3s-agent-uninstall.sh
|
|
else
|
|
echo "no k3s installed on this node"
|
|
fi
|
|
|
|
# Clean up residual state
|
|
rm -rf /etc/rancher/k3s /var/lib/rancher/k3s /var/lib/kubelet /var/lib/cni
|
|
rm -f /etc/systemd/system/k3s.service /etc/systemd/system/k3s-agent.service
|
|
systemctl daemon-reload
|
|
|
|
# Clean network interfaces left by k3s/flannel
|
|
ip link delete cni0 2>/dev/null || true
|
|
ip link delete flannel.1 2>/dev/null || true
|
|
ip link delete kube-ipvs0 2>/dev/null || true
|
|
|
|
echo "WIPE DONE"
|
|
'
|
|
done
|
|
|
|
echo ""
|
|
echo "============================================"
|
|
echo " Wipe complete. Ready for bootstrap."
|
|
echo "============================================"
|