mrcharles
8f1642bf96
Bootstrap a regular (non-ITAR) k3s cluster on cnode1/2/3 with embedded
etcd. All cluster communication — node registration, API server, etcd
peering, flannel VXLAN — runs exclusively over Tailscale IPs. Zero LAN
addresses appear in node status or TLS certificates.
Scripts (k8s/):
- env.sh: shared config (Tailscale IPs, SSH opts, k3s version)
- wipe.sh: remove existing k3s from all cnodes
- install-cp.sh: full bootstrap (cnode1 --cluster-init, then cnode2/3 join)
- join-servers.sh: re-join cnode2/3 only (fixes broken join state)
- post-setup.sh: apply NoSchedule taints, fetch kubeconfig, verify
- verify.sh: 13-point health check (nodes, Tailscale IPs, taints, etcd,
CoreDNS, API server, workload isolation)
- probe-nodes.sh: SSH + Tailscale reachability check
All 3 cnodes are tainted control-plane:NoSchedule so no user workloads
can schedule on the control plane. 13/13 health checks pass.
Docs updated: k8s README TL;DR reflects k3s (not Talos) as the deployed
choice, with Talos preserved for the future ITAR cluster.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
17 lines
523 B
Bash
17 lines
523 B
Bash
#!/usr/bin/bash
|
|
# k8s/probe-nodes.sh — verify SSH + Tailscale reachability on all cnodes
|
|
set -uo pipefail
|
|
source "$(cd "$(dirname "$0")" && pwd)/env.sh"
|
|
|
|
for ip in "${ALL_CNODES[@]}"; do
|
|
echo "=== $ip ==="
|
|
ssh "${SSH_OPTS[@]}" "${SSH_USER}@${ip}" \
|
|
'echo "host=$(hostname)"; \
|
|
echo "tailscale_ip=$(tailscale ip -4)"; \
|
|
echo "k3s=$(systemctl is-active k3s 2>/dev/null)"; \
|
|
echo "kernel=$(uname -r)"; \
|
|
free -h | head -2; \
|
|
df -h / | tail -1' 2>&1 || echo "FAILED to reach $ip"
|
|
echo
|
|
done
|