[#699] split k8s platform body of work out of PFVCluster

Framework enforcement layer adopted; shellcheck clean; real kubeconfigs gitignored (example only in repo). Provenance: PFVCluster/k8s. https://projects.knownelement.com/issues/699#note-4536
2026-09-05 05:17:28 -05:00
commit a71a12ad61
31 changed files with 1954 additions and 0 deletions
@@ -0,0 +1,75 @@
+#!/usr/bin/bash
+# shellcheck disable=SC2034 # sourced config file; variables are consumed by scripts that source this
+# k8s/env.sh — shared config for all k8s scripts. Source this.
+#
+# All cluster communication goes over Tailscale IPs. No LAN IPs, ever.
+
+# --- Control plane nodes (Tailscale 100.x addresses) ---
+CNODE1_NAME="pfv-k8s-cnode1"
+CNODE1_IP="100.125.134.53"
+
+CNODE2_NAME="pfv-k8s-cnode2"
+CNODE2_IP="100.109.34.72"
+
+CNODE3_NAME="pfv-k8s-cnode3"
+CNODE3_IP="100.106.222.18"
+
+ALL_CNODES=("$CNODE1_IP" "$CNODE2_IP" "$CNODE3_IP")
+ALL_CNODE_NAMES=("$CNODE1_NAME" "$CNODE2_NAME" "$CNODE3_NAME")
+
+# Bootstrap node (first etcd member)
+BOOTSTRAP_IP="$CNODE1_IP"
+BOOTSTRAP_NAME="$CNODE1_NAME"
+
+# --- Worker nodes (Tailscale 100.x addresses) ---
+# Roster (2026-09-02, #368): the wnode-tsys5 slot was REPLACED by
+# ultix-streaming (founder ruling) — same box, joined directly.
+WNODE1_NAME="pfv-k8s-wnode-tsys3"
+WNODE1_IP="100.126.9.112"
+
+WNODE2_NAME="ultix-streaming"
+WNODE2_IP="100.101.187.119"
+
+WNODE3_NAME="pfv-k8s-wnode-tsys6"
+WNODE3_IP="100.83.49.75"
+
+WNODE4_NAME="pfv-k8s-wnode-tsys7"
+WNODE4_IP="100.119.240.11"
+
+WNODE5_NAME="pfv-k8s-wnode-tsys9"
+WNODE5_IP="100.95.201.66"
+
+# ultix-offstage: unreachable 2026-09-02 — join when it is back on the tailnet
+# WNODE6_NAME="ultix-offstage"
+# WNODE6_IP="100.70.119.59"
+
+ALL_WNODES=("$WNODE1_IP" "$WNODE2_IP" "$WNODE3_IP" "$WNODE4_IP" "$WNODE5_IP")
+ALL_WNODE_NAMES=("$WNODE1_NAME" "$WNODE2_NAME" "$WNODE3_NAME" "$WNODE4_NAME" "$WNODE5_NAME")
+
+# --- SSH ---
+SSH_USER="localuser"
+SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
+
+# --- k3s ---
+K3S_VERSION="v1.36.2+k3s1"
+K3S_API_PORT="6443"
+
+# Shared TLS SANs (all cnodes + hostnames so certs are valid cluster-wide)
+TLS_SANS=(
+  "$CNODE1_IP" "$CNODE2_IP" "$CNODE3_IP"
+  "$CNODE1_NAME" "$CNODE2_NAME" "$CNODE3_NAME"
+)
+
+# Helper: run a command on a node as root (via passwordless sudo)
+cn() {
+  local ip="$1"; shift
+  # command is intentionally expanded client-side, then run under root bash
+  # shellcheck disable=SC2029
+  ssh "${SSH_OPTS[@]}" "${SSH_USER}@${ip}" "sudo -n bash -c '$*'" 2>&1
+}
+
+# Helper: run a heredoc script on a node
+cn_file() {
+  local ip="$1"
+  ssh "${SSH_OPTS[@]}" "${SSH_USER}@${ip}" "sudo -n bash -s"
+}