cloud-init-master.yaml

#cloud-config
package_upgrade: true
package_reboot_if_required: true

apt:
  preserve_sources_list: true
  sources:
    kubernetes.list:
      keyid: A362B822F6DEDC652817EA46B53DC80D13EDEF05
      source: "deb [signed-by=$KEY_FILE] https://packages.cloud.google.com/apt/ kubernetes-xenial main"

    libcontainers.list:
      keyid: 2472D6D0D2F66AF87ABA8DA34D64390375060AA4
      source: "deb [signed-by=$KEY_FILE] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_22.04/ /"

    cri-o_{{ crio_version }}.list:
      keyid: 2472D6D0D2F66AF87ABA8DA34D64390375060AA4
      source: "deb [signed-by=$KEY_FILE] https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/{{ crio_version }}/xUbuntu_22.04/ /"

write_files:
  - path: /etc/hosts
    append: true
    content: |
      {%- for host in etc_hosts %}
      {{ host.private_ip }} {{ host.hostname }}
      {{ host.wg_ip }} {{ host.hostname }}
      {%- endfor %}
  - path: /etc/modules-load.d/k8s.conf
    content: |
      overlay
      br_netfilter
  - path: /etc/sysctl.d/k8s.conf
    content: |
      # Network Settings
      net.ipv4.ip_forward = 1
      net.bridge.bridge-nf-call-iptables = 1
      net.bridge.bridge-nf-call-ip6tables = 1
      net.ipv4.conf.all.proxy_arp = 1
      net.ipv4.conf.all.forwarding = 1

      # Filesystem and Disk I/O
      vm.dirty_ratio = 10
      vm.swappiness = 10

      # Memory Management
      vm.overcommit_memory = 1
      vm.min_free_kbytes = 65536

      # Process Scheduling
      kernel.sched_min_granularity_ns = 10000000
      kernel.sched_wakeup_granularity_ns = 15000000

      # TCP/IP Settings
      net.ipv4.tcp_keepalive_time = 600
      net.ipv4.tcp_tw_reuse = 1

      # Security
      kernel.randomize_va_space = 2
      kernel.sysrq = 0
  - path: /etc/default/kubelet
    content: |
      KUBELET_EXTRA_ARGS="--node-ip={{ cluster_advertise_address }}"
  - path: /etc/wireguard/wg0.conf
    permissions: "0600"
    content: |
      {{ wireguard_config | indent(6) }}
  - path: /etc/haproxy/haproxy.cfg
    content: |
      global
        log /dev/log    local0
        log /dev/log    local1 notice
        chroot /var/lib/haproxy
        stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
        stats timeout 30s
        user haproxy
        group haproxy
        daemon

      defaults
        log     global
        mode    tcp
        option  tcplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000

      frontend tcp_listner
        bind *:2016
        mode tcp
        option tcplog
        default_backend tcp_backend_6443

      backend tcp_backend_6443
          balance roundrobin
          mode tcp
          {%- for host in etc_hosts %}
          server {{ host.hostname }} {{ host.private_ip }}:6443 check
          {%- endfor %}
  - path: /etc/keepalived/keepalived.conf
    content: |
      global_defs {
        notification_email {
        }
        router_id LVS_DEVEL
        vrrp_skip_check_adv_addr
        vrrp_garp_interval 0
        vrrp_gna_interval 0
      }

      vrrp_script chk_haproxy {
        script "killall -0 haproxy"
        interval 2
        weight 2
      }

      vrrp_instance haproxy-vip {
        state BACKUP
        priority 50
        interface enp0s6
        virtual_router_id 60
        advert_int 1
        authentication {
          auth_type PASS
          auth_pass {{ keepalived_password }}
        }
        unicast_src_ip {{ cluster_advertise_address }}
        unicast_peer {
          {%- for host in etc_hosts %}
          {{ host.private_ip }}
          {%- endfor %}
        }

        virtual_ipaddress {
          {{ cluster_advertise_address ~ "1" }}/24
        }

        track_script {
          chk_haproxy
        }
      }

packages:
  - cri-o
  - cri-o-runc
  - haproxy
  - keepalived
  - kubeadm
  - kubectl
  - kubelet
  - wireguard

runcmd:
  # Disable the following line to stop logging all dropped packets
  - iptables -I INPUT -m limit --limit 5/min -j LOG --log-prefix "packet-drop " --log-level 7
  - iptables-save | grep -v "DROP" | grep -v "REJECT" | iptables-restore
  - iptables -I INPUT -p udp -m udp --dport 51000 -j ACCEPT
  - iptables -I INPUT -p tcp -m tcp --dport 80,443,2016 -j ACCEPT
  - iptables -I INPUT -i wg0 -j ACCEPT
  - iptables -I INPUT -i lo -j ACCEPT
  - sysctl --system
  - modprobe -a overlay br_netfilter
  - netfilter-persistent save
  - systemctl restart iptables
  - systemctl enable --now wg-quick@wg0 crio haproxy keepalived
  - kubeadm config images pull