Skip to content

Latest commit

 

History

History
89 lines (74 loc) · 2.19 KB

node-setup.org

File metadata and controls

89 lines (74 loc) · 2.19 KB

Node configuration

Checklist

New node steps CHECKLIST

  • [ ] Burn image to SD storage
  • [ ] Start the machine
  • Once the node is connected into the network, ssh into it
sudo apt update --yes
sudo apt install software-properties-common --yes
sudo add-apt-repository --yes --update ppa:ansible/ansible
sudo apt install ansible --yes
  • [ ] Run the `standard-security` runbook This will disable SSH password and root user
  • [ ] Run the `k8s-node-security` runbook This will give more security

Operative Systems

Rocky Linux

Connect through SSH to the machine #+being_src sh ssh rocky@${RASPBERRY_IP_ADDRESS}

Once you’re in, we need to do a few things

Install updates and Ansible

sudo rootfs-expand # Expand filesystem so that is uses the hole available disk
sudo dnf update -y

# Set hostname
export NODE=01
sudo hostnamectl set-hostname "k8s-node-${NODE}.local.lan" --static
sudo hostnamectl set-hostname "K8S Node ${NODE}" --pretty
sudo reboot

# Install ansible
sudo dnf install -y epel-release
sudo dnf install ansible -y

Allow ${USER} to run sudo and journalctl without password

EDITOR=vim visudo
# Uncomment following line:
%wheel	ALL=(ALL)	NOPASSWD: ALL

Disable firewalld

sudo systemctl disable firewalld --now
sudo systemctl disable nm-cloud-setup.service nm-cloud-setup.timer
sudo reboot

Create automations user

ssh-keygen -t ed25519 -f ~/.ssh/nodes.local.lan -C "[email protected]_Kubernetes"

Setup SSH server

sudo systemctl enable sshd --now
sudo systemctl status sshd.service

# Give correct permissions to authorized users
mkdir ${HOME}/.ssh
chmod 700 ~/.ssh
touch ${HOME}/.ssh/authorized_keys
chmod 600 ${HOME}/authorized_keys

Install container tools

Run `make init-global-security`

SSH Keys Creation

# Create key
ssh-keygen -t ed25519 -f ~/.ssh/nodes.local.lan -C "[email protected]_Kubernetes"
ssh-copy-id rocky@${IP_ADDRESS} ~/.ssh.nodes.local.lan.pub