49 lines
1.9 KiB
Plaintext
49 lines
1.9 KiB
Plaintext
#cloud-config
|
|
# Template for both lab guests. scripts/rebuild-seed.sh substitutes __NODE__
|
|
# and bakes this into a CIDATA seed image.
|
|
#
|
|
# Copy to kc-lab.yaml and fill the two placeholders. The real file is ignored by
|
|
# git because plain_text_passwd is a credential, however disposable.
|
|
#
|
|
# Indentation is spaces only. YAML forbids tabs, and cloud-init fails silently
|
|
# on a parse error: the guest boots as "localhost" with no user and no way in.
|
|
hostname: kc-lab-__NODE__
|
|
fqdn: kc-lab-__NODE__
|
|
manage_etc_hosts: true
|
|
|
|
users:
|
|
- name: donghyeon
|
|
groups: [sudo]
|
|
shell: /bin/bash
|
|
# NOPASSWD is required: the k3s installer and the fault-injection scripts
|
|
# run non-interactively and would block on a password prompt.
|
|
#
|
|
# A string, not a list. The list form still boots, but `cloud-init schema -c`
|
|
# (22.4.2 on the guests) rejects it and prints the whole users.0 block with
|
|
# "is not valid under any of the given schemas" — naming no key. That makes
|
|
# the guide's own validation step look broken when it is not.
|
|
sudo: "ALL=(ALL) NOPASSWD:ALL"
|
|
# Console-only escape hatch. Without it, a cloud-init failure leaves a guest
|
|
# that cannot be logged into at all, so its own failure log is unreadable.
|
|
# ssh_pwauth stays false, so this never widens SSH exposure.
|
|
lock_passwd: false
|
|
plain_text_passwd: CHANGE_ME
|
|
ssh_authorized_keys:
|
|
# Lab host key: needed because automation runs from the lab host, where
|
|
# agent forwarding is not available.
|
|
- CHANGE_ME_LAB_HOST_PUBLIC_KEY
|
|
# Workstation key: lets ProxyJump reach the guest directly.
|
|
- CHANGE_ME_WORKSTATION_PUBLIC_KEY
|
|
|
|
ssh_pwauth: false
|
|
package_update: true
|
|
packages:
|
|
- curl
|
|
- nftables
|
|
# kc-lab-edge only. The k3s nodes do not need these, and the edge does not need
|
|
# anything else — nginx terminates TLS and certbot renews the certificate, both
|
|
# inside this disposable guest.
|
|
# - nginx
|
|
# - certbot
|
|
# - python3-certbot-dns-cloudflare
|