feat: linuxaid-agent operator + masterless puppet apply on Kubernetes nodes#1
Open
ashish1099 wants to merge 8 commits into
Open
feat: linuxaid-agent operator + masterless puppet apply on Kubernetes nodes#1ashish1099 wants to merge 8 commits into
ashish1099 wants to merge 8 commits into
Conversation
run-openvox has always run report-only (`puppet agent -t --noop`), even though puppet.conf unconditionally sets `noop = true`. There was no way to actually apply changes through the CLI itself. Add an opt-in --enforce flag: when set, run-openvox runs `puppet agent -t --no-noop --detailed-exitcodes` instead, which overrides the config-level noop setting and applies changes. Default behavior (flag unset) is unchanged. The connectivity gate, ServerPing, and last-run-report wrapper around the puppet invocation are untouched. This flag is consumed by the launcher image added in this branch (Dockerfile / deploy/entrypoint.sh), which gates it behind an ENFORCE env var and defaults to report-only.
Adds a multi-stage Dockerfile that builds the static linuxaid-cli binary and packages it into a minimal alpine runtime (bash + util-linux for nsenter). The image is a delivery/scheduling shell only: deploy/entrypoint.sh stages the binary onto the host and runs the agent inside the host's namespaces via nsenter, because package/user/sudo management must happen on the host, not inside the container. The entrypoint installs a pre-signed obmondo-clientcert (mounted into the pod) into the host's puppet SSL tree under CERTNAME, writes a minimal puppet.conf, and runs run-openvox, gating the --enforce flag added in the previous commit behind an ENFORCE env var (default false, report-only). The image ships no linuxaid-install — the cert is provided pre-signed, so there is nothing to enroll — and fails fast if the openvox agent isn't already installed on the host. Intended to run as a per-node Kubernetes Job with hostPID and privileged/CAP_SYS_ADMIN for nsenter, and /opt/obmondo hostPath mounted for binary staging.
Add cmd/linuxaid-agent, an in-cluster controller that lists nodes over the k8s REST API (SA token + CA, no client-go) and creates one per-node agent Job each run; a deterministic name means a still-running Job is skipped (no-concurrency). Split the image build: Dockerfile builds the host agent (linuxaid-cli + nsenter entrypoint), Dockerfile.launcher builds the minimal non-root linuxaid-agent controller.
…aemon The operator reconciles one agent Job per node immediately and then every --interval (default 4h), re-reading the rotated SA token per request. A single node can be triggered on demand with --node <name>, which skips cleanly when that node's Job already exists.
--apply compiles the catalog locally from the cloned control-repo (--environmentpath/--openvox-environment) with the Helm-values data as the global hiera layer (--hiera-config), skipping puppetserver resolution and connectivity gating. Exit-code policy is shared with agent mode.
…es-as-hiera Apply mode (CONTROL_REPO_URL set) shallow-clones the repo at CONTROL_REPO_REF into the /opt/obmondo hostPath, stages the mounted ConfigMap values and a generated global-layer hiera.yaml next to it, and runs linuxaid-cli run-openvox --apply on the host. Agent mode is unchanged; the runtime image gains git and openssh-client for the in-container clone.
linuxaid.tag pins the control-repo checkout and is injected into the rendered hiera ConfigMap as common::system::openvox::environment; the free-form hiera block is the cluster-wide node data. Templates cover the operator Deployment and its ServiceAccount/RBAC (nodes get+list, jobs create).
OBMONDO_SKIP_CONNECTIVITY_METRICS disables writing the .prom textfile on hosts without the node_exporter textfile collector (e.g. Kubernetes nodes), so a failed write cannot abort the run.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Run LinuxAid on Kubernetes nodes without a puppetserver.
linuxaid-agent operator: daemon creating one agent Job per node every interval (default 4h);--node <name>for a one-off run, skipped if the node's Job already exists.run-openvox --apply: masterlesspuppet applyfrom a control-repo clone pinned to a tag, with the chart values as the global hiera layer.linuxaid-agenthelm chart (deploy/chart/linuxaid-agent):linuxaid.tagpins the checkout and is injected ascommon::system::openvox::environment; free-formhiera:values become the per-cluster node data.Tracking: Obmondo/KubeAid#68