mrcharles
8f1642bf96
Bootstrap a regular (non-ITAR) k3s cluster on cnode1/2/3 with embedded
etcd. All cluster communication — node registration, API server, etcd
peering, flannel VXLAN — runs exclusively over Tailscale IPs. Zero LAN
addresses appear in node status or TLS certificates.
Scripts (k8s/):
- env.sh: shared config (Tailscale IPs, SSH opts, k3s version)
- wipe.sh: remove existing k3s from all cnodes
- install-cp.sh: full bootstrap (cnode1 --cluster-init, then cnode2/3 join)
- join-servers.sh: re-join cnode2/3 only (fixes broken join state)
- post-setup.sh: apply NoSchedule taints, fetch kubeconfig, verify
- verify.sh: 13-point health check (nodes, Tailscale IPs, taints, etcd,
CoreDNS, API server, workload isolation)
- probe-nodes.sh: SSH + Tailscale reachability check
All 3 cnodes are tainted control-plane:NoSchedule so no user workloads
can schedule on the control plane. 13/13 health checks pass.
Docs updated: k8s README TL;DR reflects k3s (not Talos) as the deployed
choice, with Talos preserved for the future ITAR cluster.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
40 lines
701 B
Plaintext
40 lines
701 B
Plaintext
# Crush internal state
|
|
.crush/
|
|
|
|
# OS/editor
|
|
.DS_Store
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
\#*\#
|
|
.\#*
|
|
|
|
# Python bytecode
|
|
__pycache__/
|
|
*.pyc
|
|
|
|
# Temporary files
|
|
*.tmp
|
|
*.bak
|
|
*.log.tmp
|
|
|
|
# LOGFILENAME artifacts: the framework (Logging.sh + PrettyPrint.sh) appends
|
|
# every print_info/print_error line to LOGFILENAME, defined as
|
|
# "$0.<Weekday>-YYYY-MM-DD-HH:MM:SS.$$". Running any script that sources the
|
|
# framework therefore drops a timestamped log file next to it.
|
|
*.Monday-*
|
|
*.Tuesday-*
|
|
*.Wednesday-*
|
|
*.Thursday-*
|
|
*.Friday-*
|
|
*.Saturday-*
|
|
*.Sunday-*
|
|
|
|
# Sensitive exports / runtime data
|
|
dns-cluster-setup/.export/
|
|
returned-logs/
|
|
|
|
# Kubernetes secrets (kubeconfig contains embedded client certs)
|
|
k8s/kubeconfig.yaml
|
|
k8s/*.token
|