ce7cb702218693d08ea6d83464d2457c9250027c

scripts/k3s/install.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Usage: install.sh server|agent <ssh-target>
+set -euo pipefail
+set +o xtrace 2>/dev/null || true
+
+VAULT_PATH="${K3S_VAULT_PATH:-secret/k3s}"
+VAULT_FIELD="${K3S_VAULT_FIELD:-server-token}"
+INSTALL_K3S_VERSION="${INSTALL_K3S_VERSION:-v1.36.2+k3s1}"
+REMOTE_CONFIG=/etc/rancher/k3s/config.yaml
+
+die() { echo "error: $*" >&2; exit 1; }
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: install.sh server|agent <ssh-target>
+EOF
+  exit 2
+}
+
+scrub() {
+  token=''
+  unset token 2>/dev/null || true
+}
+
+trap scrub EXIT
+
+[[ $# -eq 2 ]] || usage
+role=$1
+target=$2
+
+case "$role" in
+  server|agent) ;;
+  *) die "role must be server or agent (got: $role)" ;;
+esac
+[[ -n "$target" ]] || die "ssh-target is empty"
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
+case "$role" in
+  server) config=$script_dir/config.server.yaml ;;
+  agent)  config=$script_dir/config.agent-nas.yaml ;;
+esac
+[[ -f "$config" ]] || die "missing config: $config"
+
+if grep -qE '^[[:space:]]*token:[[:space:]]' "$config"; then
+  die "config must not contain token: ($config)"
+fi
+
+command -v vault >/dev/null || die "vault CLI not found"
+command -v ssh >/dev/null || die "ssh not found"
+command -v scp >/dev/null || die "scp not found"
+
+token=$(vault kv get -field="$VAULT_FIELD" "$VAULT_PATH") \
+  || die "failed to read $VAULT_FIELD from $VAULT_PATH"
+[[ -n "$token" ]] || die "empty token from $VAULT_PATH field $VAULT_FIELD"
+
+echo "role=$role target=$target config=$config version=$INSTALL_K3S_VERSION"
+
+ssh -o BatchMode=yes "$target" "install -d -m 0755 /etc/rancher/k3s"
+scp -o BatchMode=yes -q "$config" "${target}:/tmp/k3s-config.yaml"
+ssh -o BatchMode=yes "$target" "install -m 0600 /tmp/k3s-config.yaml $REMOTE_CONFIG && rm -f /tmp/k3s-config.yaml"
+
+# K3S_TOKEN must not appear in ssh/remote argv (visible in ps).
+ssh -o BatchMode=yes "$target" 'bash -s' <<EOF
+set -euo pipefail
+set +o xtrace 2>/dev/null || true
+export INSTALL_K3S_VERSION=$(printf '%q' "$INSTALL_K3S_VERSION")
+export K3S_TOKEN=$(printf '%q' "$token")
+curl -sfL https://get.k3s.io | sh -s - $(printf '%q' "$role")
+unset K3S_TOKEN
+EOF
+
+scrub
+echo "install finished on $target ($role)"