From 8c07e3f27be5d484c9ea52bcfcc23d03ea95f294 Mon Sep 17 00:00:00 2001 From: juvdiaz Date: Thu, 2 Jul 2026 21:02:49 -0600 Subject: [PATCH] wait on iptables lock --- bootstrap/platform/main.tf | 56 +++++++++----------------------- bootstrap/provisioning/README.md | 2 ++ jeannie | 26 ++++++++++++--- 3 files changed, 38 insertions(+), 46 deletions(-) diff --git a/bootstrap/platform/main.tf b/bootstrap/platform/main.tf index cce773a..2796ffe 100644 --- a/bootstrap/platform/main.tf +++ b/bootstrap/platform/main.tf @@ -1105,19 +1105,7 @@ resource "helm_release" "argocd" { } } applicationSet = { - nodeSelector = local.argocd_node_selector - affinity = local.argocd_component_affinity.application_set - topologySpreadConstraints = local.argocd_component_topology_spread_constraints.application_set - resources = { - requests = { - cpu = "100m" - memory = "256Mi" - } - limits = { - cpu = "300m" - memory = "512Mi" - } - } + replicas = 0 } controller = { nodeSelector = local.argocd_node_selector @@ -1125,8 +1113,8 @@ resource "helm_release" "argocd" { topologySpreadConstraints = local.argocd_component_topology_spread_constraints.controller resources = { requests = { - cpu = "100m" - memory = "256Mi" + cpu = "75m" + memory = "192Mi" } limits = { cpu = "300m" @@ -1138,19 +1126,7 @@ resource "helm_release" "argocd" { enabled = false } notifications = { - nodeSelector = local.argocd_node_selector - affinity = local.argocd_component_affinity.notifications - topologySpreadConstraints = local.argocd_component_topology_spread_constraints.notifications - resources = { - requests = { - cpu = "100m" - memory = "256Mi" - } - limits = { - cpu = "300m" - memory = "512Mi" - } - } + enabled = false } redis = { nodeSelector = local.argocd_node_selector @@ -1158,12 +1134,12 @@ resource "helm_release" "argocd" { topologySpreadConstraints = local.argocd_component_topology_spread_constraints.redis resources = { requests = { - cpu = "100m" - memory = "256Mi" + cpu = "25m" + memory = "64Mi" } limits = { - cpu = "300m" - memory = "512Mi" + cpu = "100m" + memory = "128Mi" } } } @@ -1173,12 +1149,12 @@ resource "helm_release" "argocd" { topologySpreadConstraints = local.argocd_component_topology_spread_constraints.repo_server resources = { requests = { - cpu = "100m" - memory = "256Mi" + cpu = "50m" + memory = "128Mi" } limits = { cpu = "300m" - memory = "512Mi" + memory = "384Mi" } } } @@ -1188,12 +1164,12 @@ resource "helm_release" "argocd" { topologySpreadConstraints = local.argocd_component_topology_spread_constraints.server resources = { requests = { - cpu = "100m" - memory = "256Mi" + cpu = "50m" + memory = "128Mi" } limits = { cpu = "300m" - memory = "512Mi" + memory = "384Mi" } } } @@ -1209,7 +1185,7 @@ resource "null_resource" "argocd_ready" { namespace = var.argocd.namespace version = var.argocd.version node_selector = jsonencode(local.argocd_node_selector) - readiness_check = "4" + readiness_check = "5" } provisioner "local-exec" { @@ -1272,9 +1248,7 @@ wait_for_argocd_component() { } kubectl --kubeconfig "${self.triggers.kubeconfig_path}" wait --for=condition=Established --timeout=180s crd/applications.argoproj.io -wait_for_argocd_component deployment/argocd-applicationset-controller app.kubernetes.io/name=argocd-applicationset-controller wait_for_argocd_component statefulset/argocd-application-controller app.kubernetes.io/name=argocd-application-controller -wait_for_argocd_component deployment/argocd-notifications-controller app.kubernetes.io/name=argocd-notifications-controller wait_for_argocd_component deployment/argocd-redis app.kubernetes.io/name=argocd-redis wait_for_argocd_component deployment/argocd-repo-server app.kubernetes.io/name=argocd-repo-server wait_for_argocd_component deployment/argocd-server app.kubernetes.io/name=argocd-server diff --git a/bootstrap/provisioning/README.md b/bootstrap/provisioning/README.md index 8fc9460..e71455d 100644 --- a/bootstrap/provisioning/README.md +++ b/bootstrap/provisioning/README.md @@ -157,6 +157,8 @@ adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=fal only when the Pimox host firewall already permits bridged worker IP traffic. Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`. +When another process holds the xtables lock, Jeannie waits up to +`${LAB_PIMOX_WORKER_IPTABLES_WAIT_SECONDS:-60}` seconds before failing. Worker NIC MAC addresses default to the VMID-derived deterministic format used by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto` only when Pimox-generated MAC addresses are preferred. diff --git a/jeannie b/jeannie index 481bb1e..cdace2a 100755 --- a/jeannie +++ b/jeannie @@ -1614,6 +1614,22 @@ if [ -z \"\$iptables_bin\" ]; then echo 'iptables not found on Pimox host and could not be installed; cannot configure worker forwarding rules.' >&2 exit 1 fi +iptables_wait_seconds='${LAB_PIMOX_WORKER_IPTABLES_WAIT_SECONDS:-60}' +case \"\$iptables_wait_seconds\" in + ''|*[!0-9]*) + echo \"LAB_PIMOX_WORKER_IPTABLES_WAIT_SECONDS must be a non-negative integer, got '\$iptables_wait_seconds'.\" >&2 + exit 1 + ;; +esac +iptables_wait_args= +if \"\$iptables_bin\" -h 2>&1 | grep -q -- ' -w'; then + iptables_wait_args=\"-w \$iptables_wait_seconds\" +else + echo 'Pimox host iptables does not support -w; proceeding without xtables lock wait.' +fi +iptables_cmd() { + sudo \"\$iptables_bin\" \$iptables_wait_args \"\$@\" +} iptables_save_bin=\"\$(command -v iptables-save 2>/dev/null || true)\" if [ -z \"\$iptables_save_bin\" ] && [ -x /usr/sbin/iptables-save ]; then iptables_save_bin=/usr/sbin/iptables-save @@ -1633,14 +1649,14 @@ sudo mkdir -p /etc/sysctl.d printf '%s\n' 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-homelab-pimox-worker-forwarding.conf >/dev/null sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null chain=FORWARD -if sudo \"\$iptables_bin\" -S DOCKER-USER >/dev/null 2>&1; then +if iptables_cmd -S DOCKER-USER >/dev/null 2>&1; then chain=DOCKER-USER fi -if ! sudo \"\$iptables_bin\" -C \"\$chain\" -s '${worker_address}/32' -j ACCEPT 2>/dev/null; then - sudo \"\$iptables_bin\" -I \"\$chain\" 1 -s '${worker_address}/32' -j ACCEPT +if ! iptables_cmd -C \"\$chain\" -s '${worker_address}/32' -j ACCEPT 2>/dev/null; then + iptables_cmd -I \"\$chain\" 1 -s '${worker_address}/32' -j ACCEPT fi -if ! sudo \"\$iptables_bin\" -C \"\$chain\" -d '${worker_address}/32' -j ACCEPT 2>/dev/null; then - sudo \"\$iptables_bin\" -I \"\$chain\" 1 -d '${worker_address}/32' -j ACCEPT +if ! iptables_cmd -C \"\$chain\" -d '${worker_address}/32' -j ACCEPT 2>/dev/null; then + iptables_cmd -I \"\$chain\" 1 -d '${worker_address}/32' -j ACCEPT fi echo \"Pimox worker forwarding rules active in \$chain for ${worker_address}\"" }