Drop initial code
This commit is contained in:
Danny Bessems
69
deploy/rig-operator/internal/templates/harvester/embed.go
Normal file
69
deploy/rig-operator/internal/templates/harvester/embed.go
Normal file
@@ -0,0 +1,69 @@
|
||||
package harvester
|
||||
|
||||
import (
|
||||
_ "embed"
|
||||
"fmt"
|
||||
|
||||
"gopkg.in/yaml.v3"
|
||||
)
|
||||
|
||||
//go:embed values.yaml
|
||||
var valuesYAML []byte
|
||||
|
||||
type Defaults struct {
|
||||
CP_CPU int
|
||||
CP_Mem int
|
||||
CP_Disk int
|
||||
|
||||
ChartRepo string
|
||||
ChartName string
|
||||
ChartVersion string
|
||||
|
||||
// [NEW] Default UserData for this provider
|
||||
UserData string
|
||||
}
|
||||
|
||||
func GetDefaults() (Defaults, error) {
|
||||
var raw map[string]interface{}
|
||||
if err := yaml.Unmarshal(valuesYAML, &raw); err != nil {
|
||||
return Defaults{}, fmt.Errorf("failed to parse harvester base values: %w", err)
|
||||
}
|
||||
|
||||
d := Defaults{
|
||||
CP_CPU: 4, CP_Mem: 8, CP_Disk: 40, // Safety Fallbacks
|
||||
}
|
||||
|
||||
if defs, ok := raw["_defaults"].(map[string]interface{}); ok {
|
||||
if cp, ok := defs["controlPlaneProfile"].(map[string]interface{}); ok {
|
||||
if v, ok := cp["cpuCores"].(int); ok {
|
||||
d.CP_CPU = v
|
||||
}
|
||||
if v, ok := cp["memoryGb"].(int); ok {
|
||||
d.CP_Mem = v
|
||||
}
|
||||
if v, ok := cp["diskGb"].(int); ok {
|
||||
d.CP_Disk = v
|
||||
}
|
||||
}
|
||||
if chart, ok := defs["helmChart"].(map[string]interface{}); ok {
|
||||
if v, ok := chart["repo"].(string); ok {
|
||||
d.ChartRepo = v
|
||||
}
|
||||
if v, ok := chart["name"].(string); ok {
|
||||
d.ChartName = v
|
||||
}
|
||||
if v, ok := chart["version"].(string); ok {
|
||||
d.ChartVersion = v
|
||||
}
|
||||
}
|
||||
// [NEW] Extract UserData
|
||||
if v, ok := defs["userData"].(string); ok {
|
||||
d.UserData = v
|
||||
}
|
||||
}
|
||||
return d, nil
|
||||
}
|
||||
|
||||
func GetBaseValues() []byte {
|
||||
return valuesYAML
|
||||
}
|
||||
456
deploy/rig-operator/internal/templates/harvester/values.yaml
Normal file
456
deploy/rig-operator/internal/templates/harvester/values.yaml
Normal file
@@ -0,0 +1,456 @@
|
||||
# ----------------------------------------------------------------
|
||||
# BASE TEMPLATE (internal/templates/base_values.yaml)
|
||||
# ----------------------------------------------------------------
|
||||
|
||||
_defaults:
|
||||
helmChart:
|
||||
repo: ""
|
||||
name: "oci://ghcr.io/rancherfederal/charts/rancher-cluster-templates"
|
||||
version: "0.7.2"
|
||||
controlPlaneProfile:
|
||||
cpuCores: 4
|
||||
memoryGb: 8
|
||||
diskGb: 40
|
||||
userData: &userData |
|
||||
#cloud-config
|
||||
package_update: false
|
||||
package_upgrade: false
|
||||
snap:
|
||||
commands:
|
||||
00: snap refresh --hold=forever
|
||||
package_reboot_if_required: true
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
- yq
|
||||
- jq
|
||||
- curl
|
||||
- wget
|
||||
|
||||
bootcmd:
|
||||
- sysctl -w net.ipv6.conf.all.disable_ipv6=1
|
||||
- sysctl -w net.ipv6.conf.default.disable_ipv6=1
|
||||
|
||||
write_files:
|
||||
# ----------------------------------------------------------------
|
||||
# 1. CNI Permission Fix Script & Cron (CIS 1.1.9 Persistence)
|
||||
# ----------------------------------------------------------------
|
||||
- path: /usr/local/bin/fix-cni-perms.sh
|
||||
permissions: '0700'
|
||||
owner: root:root
|
||||
content: |
|
||||
#!/bin/bash
|
||||
# Wait 60s on boot for RKE2 to write files
|
||||
[ "$1" == "boot" ] && sleep 60
|
||||
|
||||
# Enforce 600 on CNI files (CIS 1.1.9)
|
||||
if [ -d /etc/cni/net.d ]; then
|
||||
find /etc/cni/net.d -type f -exec chmod 600 {} \;
|
||||
fi
|
||||
if [ -d /var/lib/cni/networks ]; then
|
||||
find /var/lib/cni/networks -type f -exec chmod 600 {} \;
|
||||
fi
|
||||
|
||||
# Every RKE2 service restart can reset CNI file permissions, so we run
|
||||
# this script on reboot and daily via cron to maintain CIS compliance.
|
||||
|
||||
- path: /etc/cron.d/cis-cni-fix
|
||||
permissions: '0644'
|
||||
owner: root:root
|
||||
content: |
|
||||
# Run on Reboot (with delay) to fix files created during startup
|
||||
@reboot root /usr/local/bin/fix-cni-perms.sh boot
|
||||
# Run once daily at 00:00 to correct any drift
|
||||
0 0 * * * root /usr/local/bin/fix-cni-perms.sh
|
||||
|
||||
# ----------------------------------------------------------------
|
||||
# 2. RKE2 Admission Config
|
||||
# ----------------------------------------------------------------
|
||||
- path: /etc/rancher/rke2/rke2-admission.yaml
|
||||
permissions: '0600'
|
||||
owner: root:root
|
||||
content: |
|
||||
apiVersion: apiserver.config.k8s.io/v1
|
||||
kind: AdmissionConfiguration
|
||||
plugins:
|
||||
- name: PodSecurity
|
||||
configuration:
|
||||
apiVersion: pod-security.admission.config.k8s.io/v1beta1
|
||||
kind: PodSecurityConfiguration
|
||||
defaults:
|
||||
enforce: "restricted"
|
||||
enforce-version: "latest"
|
||||
audit: "restricted"
|
||||
audit-version: "latest"
|
||||
warn: "restricted"
|
||||
warn-version: "latest"
|
||||
exemptions:
|
||||
usernames: []
|
||||
runtimeClasses: []
|
||||
namespaces: [compliance-operator-system,kube-system, cis-operator-system, tigera-operator, calico-system, rke2-ingress-nginx, cattle-system, cattle-fleet-system, longhorn-system, cattle-neuvector-system]
|
||||
- name: EventRateLimit
|
||||
configuration:
|
||||
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
|
||||
kind: Configuration
|
||||
limits:
|
||||
- type: Server
|
||||
qps: 5000
|
||||
burst: 20000
|
||||
|
||||
# ----------------------------------------------------------------
|
||||
# 3. RKE2 Audit Policy
|
||||
# ----------------------------------------------------------------
|
||||
- path: /etc/rancher/rke2/audit-policy.yaml
|
||||
permissions: '0600'
|
||||
owner: root:root
|
||||
content: |
|
||||
apiVersion: audit.k8s.io/v1
|
||||
kind: Policy
|
||||
rules:
|
||||
- level: None
|
||||
users: ["system:kube-controller-manager", "system:kube-scheduler", "system:serviceaccount:kube-system:endpoint-controller"]
|
||||
verbs: ["get", "update"]
|
||||
resources:
|
||||
- group: ""
|
||||
resources: ["endpoints", "services", "services/status"]
|
||||
- level: None
|
||||
verbs: ["get"]
|
||||
resources:
|
||||
- group: ""
|
||||
resources: ["nodes", "nodes/status", "pods", "pods/status"]
|
||||
- level: None
|
||||
users: ["kube-proxy"]
|
||||
verbs: ["watch"]
|
||||
resources:
|
||||
- group: ""
|
||||
resources: ["endpoints", "services", "services/status", "configmaps"]
|
||||
- level: Metadata
|
||||
resources:
|
||||
- group: ""
|
||||
resources: ["secrets", "configmaps"]
|
||||
- level: RequestResponse
|
||||
omitStages:
|
||||
- RequestReceived
|
||||
|
||||
# ----------------------------------------------------------------
|
||||
# 4. Static NetworkPolicies
|
||||
# ----------------------------------------------------------------
|
||||
- path: /var/lib/rancher/rke2/server/manifests/cis-network-policy.yaml
|
||||
permissions: '0600'
|
||||
owner: root:root
|
||||
content: |
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny-ingress
|
||||
namespace: default
|
||||
spec:
|
||||
podSelector: {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: allow-all-metrics
|
||||
namespace: kube-public
|
||||
spec:
|
||||
podSelector: {}
|
||||
ingress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: allow-all-system
|
||||
namespace: kube-system
|
||||
spec:
|
||||
podSelector: {}
|
||||
ingress:
|
||||
- {}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
|
||||
# ----------------------------------------------------------------
|
||||
# 5. Service Account Hardening
|
||||
# ----------------------------------------------------------------
|
||||
- path: /var/lib/rancher/rke2/server/manifests/cis-sa-config.yaml
|
||||
permissions: '0600'
|
||||
owner: root:root
|
||||
content: |
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: default
|
||||
namespace: default
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: default
|
||||
namespace: kube-system
|
||||
automountServiceAccountToken: false
|
||||
|
||||
- path: /var/lib/rancher/rke2/server/manifests/cis-sa-cron.yaml
|
||||
permissions: '0600'
|
||||
owner: root:root
|
||||
content: |
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata: {name: sa-cleaner, namespace: kube-system}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata: {name: sa-cleaner-role}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces", "serviceaccounts"]
|
||||
verbs: ["get", "list", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata: {name: sa-cleaner-binding}
|
||||
subjects: [{kind: ServiceAccount, name: sa-cleaner, namespace: kube-system}]
|
||||
roleRef: {kind: ClusterRole, name: sa-cleaner-role, apiGroup: rbac.authorization.k8s.io}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: sa-cleaner
|
||||
namespace: kube-system
|
||||
spec:
|
||||
schedule: "0 */6 * * *" # Run every 6 hours
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: sa-cleaner
|
||||
containers:
|
||||
- name: cleaner
|
||||
image: rancher/kubectl:v1.26.0
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
# Get all namespaces
|
||||
for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
|
||||
# Check if default SA has automount=true (or null)
|
||||
automount=$(kubectl get sa default -n $ns -o jsonpath='{.automountServiceAccountToken}')
|
||||
if [ "$automount" != "false" ]; then
|
||||
echo "Securing default SA in namespace: $ns"
|
||||
kubectl patch sa default -n $ns -p '{"automountServiceAccountToken": false}'
|
||||
fi
|
||||
done
|
||||
restartPolicy: OnFailure
|
||||
|
||||
# ----------------------------------------------------------------
|
||||
# 6. OS Sysctls Hardening
|
||||
# ----------------------------------------------------------------
|
||||
- path: /etc/sysctl.d/60-rke2-cis.conf
|
||||
permissions: '0644'
|
||||
content: |
|
||||
vm.overcommit_memory=1
|
||||
vm.max_map_count=65530
|
||||
vm.panic_on_oom=0
|
||||
fs.inotify.max_user_watches=1048576
|
||||
fs.inotify.max_user_instances=8192
|
||||
kernel.panic=10
|
||||
kernel.panic_on_oops=1
|
||||
net.ipv4.conf.all.rp_filter=1
|
||||
net.ipv4.conf.default.rp_filter=1
|
||||
net.ipv4.conf.all.accept_source_route=0
|
||||
net.ipv4.conf.default.accept_source_route=0
|
||||
net.ipv4.conf.all.accept_redirects=0
|
||||
net.ipv4.conf.default.accept_redirects=0
|
||||
net.ipv4.conf.all.send_redirects=0
|
||||
net.ipv4.conf.default.send_redirects=0
|
||||
net.ipv4.conf.all.log_martians=1
|
||||
net.ipv4.conf.default.log_martians=1
|
||||
net.ipv4.icmp_echo_ignore_broadcasts=1
|
||||
net.ipv4.icmp_ignore_bogus_error_responses=1
|
||||
net.ipv6.conf.all.disable_ipv6=1
|
||||
net.ipv6.conf.default.disable_ipv6=1
|
||||
fs.protected_hardlinks=1
|
||||
fs.protected_symlinks=1
|
||||
|
||||
# ----------------------------------------------------------------
|
||||
# 7. Environment & Setup Scripts
|
||||
# ----------------------------------------------------------------
|
||||
- path: /etc/profile.d/rke2.sh
|
||||
permissions: '0644'
|
||||
content: |
|
||||
export PATH=$PATH:/var/lib/rancher/rke2/bin:/opt/rke2/bin
|
||||
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
|
||||
|
||||
|
||||
- path: /root/updates.sh
|
||||
permissions: '0550'
|
||||
content: |
|
||||
#!/bin/bash
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-mark hold linux-headers-generic
|
||||
apt-mark hold linux-headers-virtual
|
||||
apt-mark hold linux-image-virtual
|
||||
apt-mark hold linux-virtual
|
||||
apt-get update
|
||||
apt-get upgrade -y
|
||||
apt-get autoremove -y
|
||||
|
||||
users:
|
||||
- name: rancher
|
||||
gecos: Rancher service account
|
||||
hashed_passwd: $6$Mas.x2i7B2cefjUy$59363FmEuoU.LiTLNRZmtemlH2W0D0SWsig22KSZ3QzOmfxeZXxdSx5wIw9wO7GXF/M9W.9SHoKVBOYj1HPX3.
|
||||
lock_passwd: false
|
||||
shell: /bin/bash
|
||||
groups: [users, sudo, docker]
|
||||
sudo: ALL=(ALL:ALL) ALL
|
||||
ssh_authorized_keys:
|
||||
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwWnnOTAu0LlAZRczQ0Z0KvNlUdPhGQhpZie+nF1O3s'
|
||||
|
||||
- name: etcd
|
||||
gecos: "etcd user"
|
||||
shell: /sbin/nologin
|
||||
system: true
|
||||
lock_passwd: true
|
||||
|
||||
disable_root: true
|
||||
ssh_pwauth: true
|
||||
|
||||
runcmd:
|
||||
- systemctl enable --now qemu-guest-agent
|
||||
- sysctl --system
|
||||
- /root/updates.sh
|
||||
# Immediate run of fix script
|
||||
- /usr/local/bin/fix-cni-perms.sh
|
||||
|
||||
final_message: |
|
||||
VI_CNV_CLOUD_INIT has been applied successfully.
|
||||
Node ready for Rancher!
|
||||
|
||||
# amazonec2, azure, digitalocean, harvester, vsphere, custom
|
||||
cloudprovider: harvester
|
||||
|
||||
# cloud provider credentials
|
||||
cloudCredentialSecretName: cc-mrklm
|
||||
|
||||
# rancher manager url
|
||||
rancher:
|
||||
cattle:
|
||||
url: rancher-mgmt.product.lan
|
||||
|
||||
# cluster values
|
||||
cluster:
|
||||
|
||||
name: default-cluster
|
||||
# labels:
|
||||
# key: value
|
||||
config:
|
||||
kubernetesVersion: v1.33.5+rke2r1
|
||||
enableNetworkPolicy: true
|
||||
localClusterAuthEndpoint:
|
||||
enabled: false
|
||||
chartValues:
|
||||
harvester-cloud-provider:
|
||||
global:
|
||||
cattle:
|
||||
clusterName: default-cluster
|
||||
|
||||
# Pod Security Standard (Replaces PSP)
|
||||
defaultPodSecurityAdmissionConfigurationTemplateName: "rancher-restricted"
|
||||
|
||||
globalConfig:
|
||||
systemDefaultRegistry: docker.io
|
||||
cni: canal
|
||||
docker: false
|
||||
disable_scheduler: false
|
||||
disable_cloud_controller: false
|
||||
disable_kube_proxy: false
|
||||
etcd_expose_metrics: false
|
||||
profile: 'cis'
|
||||
selinux: false
|
||||
secrets_encryption: true
|
||||
write_kubeconfig_mode: 0600
|
||||
use_service_account_credentials: false
|
||||
protect_kernel_defaults: true
|
||||
cloud_provider_name: harvester
|
||||
cloud_provider_config: secret://fleet-default:harvesterconfigzswmd
|
||||
|
||||
kube_apiserver_arg:
|
||||
- "service-account-extend-token-expiration=false"
|
||||
- "anonymous-auth=false"
|
||||
- "enable-admission-plugins=NodeRestriction,PodSecurity,EventRateLimit,DenyServiceExternalIPs"
|
||||
- "admission-control-config-file=/etc/rancher/rke2/rke2-admission.yaml"
|
||||
- "audit-policy-file=/etc/rancher/rke2/audit-policy.yaml"
|
||||
- "audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log"
|
||||
- "audit-log-maxage=30"
|
||||
- "audit-log-maxbackup=10"
|
||||
- "audit-log-maxsize=100"
|
||||
|
||||
kubelet_arg:
|
||||
# Strong Ciphers (CIS 4.2.12)
|
||||
- "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
|
||||
# PID Limit (CIS 4.2.13)
|
||||
- "pod-max-pids=4096"
|
||||
# Seccomp Default (CIS 4.2.14)
|
||||
- "seccomp-default=true"
|
||||
- "protect-kernel-defaults=true"
|
||||
- "make-iptables-util-chains=true"
|
||||
|
||||
upgradeStrategy:
|
||||
controlPlaneConcurrency: 10%
|
||||
controlPlaneDrainOptions:
|
||||
enabled: false
|
||||
workerConcurrency: 10%
|
||||
workerDrainOptions:
|
||||
enabled: false
|
||||
addons:
|
||||
monitoring:
|
||||
enabled: false
|
||||
logging:
|
||||
enabled: false
|
||||
longhorn:
|
||||
enabled: false
|
||||
neuvector:
|
||||
enabled: false
|
||||
|
||||
# node and nodepool(s) values
|
||||
# ----------------------------------------------------------------
|
||||
# MANUAL TESTING SECTION
|
||||
# The Operator will DELETE and OVERWRITE this section at runtime.
|
||||
# These values are only used if you run 'helm install' manually.
|
||||
# ----------------------------------------------------------------
|
||||
nodepools:
|
||||
- name: control-plane-nodes
|
||||
displayName: cp-nodes
|
||||
quantity: 1
|
||||
etcd: true
|
||||
controlplane: true
|
||||
worker: false
|
||||
paused: false
|
||||
cpuCount: 4
|
||||
diskSize: 40
|
||||
imageName: vanderlande/image-qhtpc
|
||||
memorySize: 8
|
||||
networkName: vanderlande/vm-lan
|
||||
sshUser: rancher
|
||||
vmNamespace: vanderlande
|
||||
userData: *userData
|
||||
|
||||
- name: worker-nodes
|
||||
displayName: wk-nodes
|
||||
quantity: 2
|
||||
etcd: false
|
||||
controlplane: false
|
||||
worker: true
|
||||
paused: false
|
||||
cpuCount: 2
|
||||
diskSize: 40
|
||||
imageName: vanderlande/image-qmx5q
|
||||
memorySize: 8
|
||||
networkName: vanderlande/vm-lan
|
||||
sshUser: rancher
|
||||
vmNamespace: vanderlande
|
||||
userData: *userData
|
||||
|
||||
Reference in New Issue
Block a user