wait on iptables lock

bootstrap/platform/main.tf

@@ -1105,19 +1105,7 @@ resource "helm_release" "argocd" {
         }
       }
       applicationSet = {
-        nodeSelector              = local.argocd_node_selector
+        replicas = 0
-        affinity                  = local.argocd_component_affinity.application_set
-        topologySpreadConstraints = local.argocd_component_topology_spread_constraints.application_set
-        resources = {
-          requests = {
-            cpu    = "100m"
-            memory = "256Mi"
-          }
-          limits = {
-            cpu    = "300m"
-            memory = "512Mi"
-          }
-        }
       }
       controller = {
         nodeSelector              = local.argocd_node_selector
@@ -1125,8 +1113,8 @@ resource "helm_release" "argocd" {
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.controller
         resources = {
           requests = {
-            cpu    = "100m"
+            cpu    = "75m"
-            memory = "256Mi"
+            memory = "192Mi"
           }
           limits = {
             cpu    = "300m"
@@ -1138,19 +1126,7 @@ resource "helm_release" "argocd" {
         enabled = false
       }
       notifications = {
-        nodeSelector              = local.argocd_node_selector
+        enabled = false
-        affinity                  = local.argocd_component_affinity.notifications
-        topologySpreadConstraints = local.argocd_component_topology_spread_constraints.notifications
-        resources = {
-          requests = {
-            cpu    = "100m"
-            memory = "256Mi"
-          }
-          limits = {
-            cpu    = "300m"
-            memory = "512Mi"
-          }
-        }
       }
       redis = {
         nodeSelector              = local.argocd_node_selector
@@ -1158,12 +1134,12 @@ resource "helm_release" "argocd" {
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.redis
         resources = {
           requests = {
-            cpu    = "100m"
+            cpu    = "25m"
-            memory = "256Mi"
+            memory = "64Mi"
           }
           limits = {
-            cpu    = "300m"
+            cpu    = "100m"
-            memory = "512Mi"
+            memory = "128Mi"
           }
         }
       }
@@ -1173,12 +1149,12 @@ resource "helm_release" "argocd" {
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.repo_server
         resources = {
           requests = {
-            cpu    = "100m"
+            cpu    = "50m"
-            memory = "256Mi"
+            memory = "128Mi"
           }
           limits = {
             cpu    = "300m"
-            memory = "512Mi"
+            memory = "384Mi"
           }
         }
       }
@@ -1188,12 +1164,12 @@ resource "helm_release" "argocd" {
         topologySpreadConstraints = local.argocd_component_topology_spread_constraints.server
         resources = {
           requests = {
-            cpu    = "100m"
+            cpu    = "50m"
-            memory = "256Mi"
+            memory = "128Mi"
           }
           limits = {
             cpu    = "300m"
-            memory = "512Mi"
+            memory = "384Mi"
           }
         }
       }
@@ -1209,7 +1185,7 @@ resource "null_resource" "argocd_ready" {
     namespace       = var.argocd.namespace
     version         = var.argocd.version
     node_selector   = jsonencode(local.argocd_node_selector)
-    readiness_check = "4"
+    readiness_check = "5"
   }
 
   provisioner "local-exec" {
@@ -1272,9 +1248,7 @@ wait_for_argocd_component() {
 }
 
 kubectl --kubeconfig "${self.triggers.kubeconfig_path}" wait --for=condition=Established --timeout=180s crd/applications.argoproj.io
-wait_for_argocd_component deployment/argocd-applicationset-controller app.kubernetes.io/name=argocd-applicationset-controller
 wait_for_argocd_component statefulset/argocd-application-controller app.kubernetes.io/name=argocd-application-controller
-wait_for_argocd_component deployment/argocd-notifications-controller app.kubernetes.io/name=argocd-notifications-controller
 wait_for_argocd_component deployment/argocd-redis app.kubernetes.io/name=argocd-redis
 wait_for_argocd_component deployment/argocd-repo-server app.kubernetes.io/name=argocd-repo-server
 wait_for_argocd_component deployment/argocd-server app.kubernetes.io/name=argocd-server

bootstrap/provisioning/README.md

@@ -157,6 +157,8 @@ adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=fal
 only when the Pimox host firewall already permits bridged worker IP traffic.
 Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
 `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
+When another process holds the xtables lock, Jeannie waits up to
+`${LAB_PIMOX_WORKER_IPTABLES_WAIT_SECONDS:-60}` seconds before failing.
 Worker NIC MAC addresses default to the VMID-derived deterministic format used
 by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`
 only when Pimox-generated MAC addresses are preferred.

jeannie

@@ -1614,6 +1614,22 @@ if [ -z \"\$iptables_bin\" ]; then
   echo 'iptables not found on Pimox host and could not be installed; cannot configure worker forwarding rules.' >&2
   exit 1
 fi
+iptables_wait_seconds='${LAB_PIMOX_WORKER_IPTABLES_WAIT_SECONDS:-60}'
+case \"\$iptables_wait_seconds\" in
+  ''|*[!0-9]*)
+    echo \"LAB_PIMOX_WORKER_IPTABLES_WAIT_SECONDS must be a non-negative integer, got '\$iptables_wait_seconds'.\" >&2
+    exit 1
+    ;;
+esac
+iptables_wait_args=
+if \"\$iptables_bin\" -h 2>&1 | grep -q -- ' -w'; then
+  iptables_wait_args=\"-w \$iptables_wait_seconds\"
+else
+  echo 'Pimox host iptables does not support -w; proceeding without xtables lock wait.'
+fi
+iptables_cmd() {
+  sudo \"\$iptables_bin\" \$iptables_wait_args \"\$@\"
+}
 iptables_save_bin=\"\$(command -v iptables-save 2>/dev/null || true)\"
 if [ -z \"\$iptables_save_bin\" ] && [ -x /usr/sbin/iptables-save ]; then
   iptables_save_bin=/usr/sbin/iptables-save
@@ -1633,14 +1649,14 @@ sudo mkdir -p /etc/sysctl.d
 printf '%s\n' 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-homelab-pimox-worker-forwarding.conf >/dev/null
 sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null
 chain=FORWARD
-if sudo \"\$iptables_bin\" -S DOCKER-USER >/dev/null 2>&1; then
+if iptables_cmd -S DOCKER-USER >/dev/null 2>&1; then
   chain=DOCKER-USER
 fi
-if ! sudo \"\$iptables_bin\" -C \"\$chain\" -s '${worker_address}/32' -j ACCEPT 2>/dev/null; then
+if ! iptables_cmd -C \"\$chain\" -s '${worker_address}/32' -j ACCEPT 2>/dev/null; then
-  sudo \"\$iptables_bin\" -I \"\$chain\" 1 -s '${worker_address}/32' -j ACCEPT
+  iptables_cmd -I \"\$chain\" 1 -s '${worker_address}/32' -j ACCEPT
 fi
-if ! sudo \"\$iptables_bin\" -C \"\$chain\" -d '${worker_address}/32' -j ACCEPT 2>/dev/null; then
+if ! iptables_cmd -C \"\$chain\" -d '${worker_address}/32' -j ACCEPT 2>/dev/null; then
-  sudo \"\$iptables_bin\" -I \"\$chain\" 1 -d '${worker_address}/32' -j ACCEPT
+  iptables_cmd -I \"\$chain\" 1 -d '${worker_address}/32' -j ACCEPT
 fi
 echo \"Pimox worker forwarding rules active in \$chain for ${worker_address}\""
 }