WIP: feat(linuxaid-agents): ArgoCD Helm chart running the OpenVox agent per node - #223
Draft
ashish1099 wants to merge 2 commits into
Draft
WIP: feat(linuxaid-agents): ArgoCD Helm chart running the OpenVox agent per node#223ashish1099 wants to merge 2 commits into
ashish1099 wants to merge 2 commits into
Conversation
…a per-node Job KubeAid nodes need a way to run the LinuxAid OpenVox agent (package, SSH key and sudo management) without SSH access, driven through ArgoCD like the rest of the cluster's components. This chart deploys a single Job per node, using the linuxaid-agents launcher image (built from linuxaid-cli's Dockerfile): the container stages the linuxaid-cli binary onto the host and runs it inside the host namespaces via nsenter, since package/user/sudo management must happen on the host, not inside the container. The Job needs hostPID + privileged for nsenter, and mounts the node's obmondo-clientcert secret plus a hostPath at .Values.hostObmondoPath for binary staging. nodeName and certname are required per-release values (one node, one customer cert, per install). enforce defaults to false (report-only --noop); flip to true once a report-only run comes back clean. Image tag currently defaults to "spike" — pin by digest once the image has a stable release tag in ghcr.io/obmondo/linuxaid-agents. Related: Obmondo/Linuxaid-cli branch worktree-linuxaid-enforce (commits 1c13a0d, 632c280) — adds the --enforce flag and the launcher Dockerfile/entrypoint this chart deploys.
Replace the single per-node Job with a non-privileged launcher CronJob that lists the cluster's nodes and creates one ephemeral privileged agent Job per node each run, so no node list is maintained; deterministic Job names give no-concurrency. Adds RBAC (list nodes cluster-wide, create jobs in the namespace) and runs the linuxaid-agent launcher image, passing the per-node agent image through to the spawned Jobs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
WIP — not ready to merge.
Adds
argocd-helm-charts/linuxaid-agents, a new chart that runs the LinuxAid OpenVox (Puppet) agent on KubeAid nodes to manage node-OS state (packages, SSH keys, sudo). This targets the day-2 node-OS gap that Cluster API leaves open on bare metal.How it works
Not a DaemonSet, and no static node list. The chart deploys a single non-privileged launcher CronJob (hourly by default):
linuxaid-agent fanout, discovering nodes through the Kubernetes API.linuxaid-clionto the node under/opt/obmondoand runspuppet applymasterless (no Puppet server required).ttlSecondsAfterFinished(600s);backoffLimit: 0means a failed run simply retries on the next schedule.RBAC
get/listonnodes— discovery only.get/list/create/deleteonbatch/jobs— to spawn the per-node Jobs.Safety defaults
enforce: false— puppet runs in noop, report-only. Flip totrueonly once runs report clean.certnameis markedrequired, so rendering fails fast rather than deploying a misconfigured agent.Prerequisites
obmondo-clientcertsecret (e.g. monitoring); that namespace must permit privileged pods under PSA./opt/puppetlabs/bin/puppet.Known WIP items
spiketag (ghcr.io/obmondo/linuxaid-agent,ghcr.io/obmondo/linuxaid-agents) — these need real released tags before merge.Testing
Not yet deployed to a cluster. This branch has been rebased onto current master (
be5784b4d); the rebase was content-neutral, adding 6 new files and no modifications to existing ones.