jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

worker SSH uses a dedicated known host file

This commit is contained in:
juvdiaz 2026-07-02 10:05:50 -06:00
parent 04d5b259c0
commit d7d83bef6a
1 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
bootstrap/cluster/main.tf
View File

@ -983,17 +983,27 @@ ssh_target='${self.triggers.user}@${self.triggers.host}'
ssh_key='${self.triggers.ssh_key_path}'
node_name='${self.triggers.node_name}'
accept_routes='${self.triggers.worker_tailscale_accept_routes}'
ssh_host="$${ssh_target#*@}"
known_hosts_file="$${TF_DATA_DIR:-.terraform}/homelab-worker-known_hosts"
if ! ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
mkdir -p "$(dirname "$known_hosts_file")"
touch "$known_hosts_file"
chmod 0600 "$known_hosts_file"
ssh-keygen -R "$ssh_host" -f "$known_hosts_file" >/dev/null 2>&1 || true
worker_ssh() {
ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile="$known_hosts_file" "$ssh_target" "$@"
}
if ! worker_ssh \
'command -v tailscale >/dev/null 2>&1 && sudo systemctl is-active --quiet tailscaled'; then
echo "tailscale is not installed or tailscaled is not active on $ssh_target" >&2
exit 1
fi
if ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
if worker_ssh \
'test -n "$(tailscale ip -4 2>/dev/null | head -n 1)"'; then
ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
"sudo tailscale set --accept-routes=$accept_routes"
worker_ssh "sudo tailscale set --accept-routes=$accept_routes"
exit 0
fi
@ -1009,11 +1019,10 @@ if [ -z "$auth_key" ]; then
fi
printf '%s\n' "$auth_key" |
ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
worker_ssh \
"read -r auth_key && sudo tailscale up --auth-key \"\$auth_key\" --hostname '$node_name' --accept-routes=$accept_routes --reset"
ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
'sudo systemctl restart homelab-tailscale-pod-egress.service 2>/dev/null || true'
worker_ssh 'sudo systemctl restart homelab-tailscale-pod-egress.service 2>/dev/null || true'
EOT
}
@ -1025,13 +1034,24 @@ set -euo pipefail
ssh_target='${self.triggers.user}@${self.triggers.host}'
ssh_key='${self.triggers.ssh_key_path}'
node_name='${self.triggers.node_name}'
ssh_host="$${ssh_target#*@}"
known_hosts_file="$${TF_DATA_DIR:-.terraform}/homelab-worker-known_hosts"
if ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
mkdir -p "$(dirname "$known_hosts_file")"
touch "$known_hosts_file"
chmod 0600 "$known_hosts_file"
ssh-keygen -R "$ssh_host" -f "$known_hosts_file" >/dev/null 2>&1 || true
worker_ssh() {
ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile="$known_hosts_file" "$ssh_target" "$@"
}
if worker_ssh \
'test -f /etc/kubernetes/kubelet.conf && test -f /var/lib/kubelet/config.yaml'; then
exit 0
fi
join_cmd="$(sudo kubeadm token create --print-join-command)"
join_cmd="$(sudo env KUBECONFIG=/etc/kubernetes/admin.conf kubeadm token create --print-join-command)"
remote_join_script="$(mktemp)"
trap 'rm -f "$remote_join_script"' EXIT
@ -1052,8 +1072,7 @@ if [ ! -f /etc/kubernetes/kubelet.conf ] || [ ! -f /var/lib/kubelet/config.yaml
fi
JOIN_EOT
ssh -i "$ssh_key" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$ssh_target" \
'bash -s' <"$remote_join_script"
worker_ssh 'bash -s' <"$remote_join_script"
EOT
}
}