host

func CheckCgroups ¶ added in v0.1.20

func CheckCgroups(log *slog.Logger) preflight.Checker

CheckCgroups verifies the host cgroup filesystem is available.

func CheckContainerBackend ¶ added in v0.24.0

func CheckContainerBackend(log *slog.Logger) preflight.Checker

CheckContainerBackend runs the container backend's own preflight: cgroup v2, systemd 254 or newer, an SELinux label the kernel accepts when enforcing, and writable /etc, /opt and /var. The OCI runtime itself is installed by the agent later in bootstrap, so a missing runtime is not an error here. PROVISIONAL: the container mode is experimental and these checks are modeled on the design, not on a verified Azure Container Linux node. It mutates nothing.

func CheckContainerdActive ¶ added in v0.2.1

func CheckContainerdActive(log *slog.Logger) preflight.Checker

CheckContainerdActive warns when the host containerd service is active.

func CheckDiskSpace ¶ added in v0.1.20

func CheckDiskSpace(log *slog.Logger) preflight.Checker

CheckDiskSpace verifies enough free disk is available for bootstrap.

func CheckDockerActive ¶ added in v0.1.20

func CheckDockerActive(log *slog.Logger) preflight.Checker

CheckDockerActive warns when Docker is active.

func CheckExistingDeploymentFor ¶ added in v0.24.0

func CheckExistingDeploymentFor(log *slog.Logger, mode isolation.Mode) preflight.Checker

CheckExistingDeploymentFor verifies the host does not already contain node deployment artifacts. Bootstrap must start from a clean host; otherwise partial state from a prior run can be reused accidentally. Modes other than nspawn also look for the artifacts of a host-native node.

func CheckHostOSConfiguration ¶ added in v0.1.20

func CheckHostOSConfiguration(log *slog.Logger) preflight.Checker

CheckHostOSConfiguration verifies host OS configuration paths are writable.

func CheckHostPackages ¶ added in v0.1.20

func CheckHostPackages(log *slog.Logger) preflight.Checker

CheckHostPackages verifies all required host packages are already installed.

func CheckIsPrivilegedUser ¶ added in v0.1.20

func CheckIsPrivilegedUser(log *slog.Logger) preflight.Checker

CheckIsPrivilegedUser verifies preflight is running as root.

func CheckKubeletActive ¶ added in v0.2.1

func CheckKubeletActive(log *slog.Logger) preflight.Checker

CheckKubeletActive warns when the host kubelet service is active.

func CheckNSpawnRuntime ¶ added in v0.1.20

func CheckNSpawnRuntime(log *slog.Logger) preflight.Checker

CheckNSpawnRuntime verifies systemd-nspawn runtime tools are available.

func CheckNoneBackend ¶ added in v0.24.0

func CheckNoneBackend(log *slog.Logger) preflight.Checker

CheckNoneBackend runs the none backend's own preflight: it fails when the host already has a kubelet or containerd the agent does not own (unit, binary or running process), or when /etc, /opt or /var is not writable. The failure names the mode to use instead, rather than switching silently. It mutates nothing.

func CheckNvidiaDriver ¶ added in v0.1.20

func CheckNvidiaDriver(log *slog.Logger) preflight.Checker

CheckNvidiaDriver validates the host NVIDIA driver stack when NVIDIA GPU hardware is present. It is a no-op success on hosts without NVIDIA GPUs.

func CheckSwapActive ¶ added in v0.1.20

func CheckSwapActive(log *slog.Logger) preflight.Checker

CheckSwapActive warns when host swap is active.

func ConfigureDocker ¶ added in v0.2.1

func ConfigureDocker(*slog.Logger) phases.Task

ConfigureDocker returns a task that prevents Docker from manipulating iptables rules, which would conflict with Kubernetes networking.

func ConfigureNFTables ¶

func ConfigureNFTables(log *slog.Logger) phases.Task

ConfigureNFTables returns a task that installs a oneshot systemd unit which flushes all nftables rules to a clean state before kubelet starts. This ensures stale rules (e.g. left behind by Docker) do not interfere with Kubernetes networking.

func ConfigureNFTablesFor ¶ added in v0.24.0

func ConfigureNFTablesFor(log *slog.Logger, mode isolation.Mode) phases.Task

ConfigureNFTablesFor is ConfigureNFTables for an isolation mode. The nspawn mode, and the empty mode, install exactly the unit they always did. The other modes have no nspawn machine to order against and no machined to ask about registered machines (their hosts do not install systemd-container), so the unit is ordered before the node's own units and "is a node running" is answered from those units.

func ConfigureOS ¶

func ConfigureOS(log *slog.Logger) phases.Task

ConfigureOS returns a task that writes host-level OS configuration (e.g. sysctl tunables) that must be in place before any nspawn machine starts so that kubelet inside the container sees the correct kernel parameter values.

func DisableContainerd ¶ added in v0.2.1

func DisableContainerd(log *slog.Logger) phases.Task

DisableContainerd returns a task that stops and masks containerd on the host.

func DisableDocker ¶

func DisableDocker(log *slog.Logger) phases.Task

DisableDocker returns a task that stops and masks Docker on the host.

func DisableKubelet ¶ added in v0.2.1

func DisableKubelet(log *slog.Logger) phases.Task

DisableKubelet returns a task that stops and masks kubelet on the host.

func DisableSwap ¶

func DisableSwap(log *slog.Logger) phases.Task

DisableSwap returns a task that disables swap on the host. Kubernetes requires swap to be off so the kubelet memory management and pod QoS guarantees work correctly. The task runs swapoff -a and comments out any swap entries in /etc/fstab so swap stays disabled across reboots. It also masks any active systemd swap units, such as Fedora's zram swap unit, because those are generated outside of /etc/fstab.

func EnsureNoExistingDeployment ¶ added in v0.1.22

func EnsureNoExistingDeployment(ctx context.Context, log *slog.Logger) error

EnsureNoExistingDeployment returns an error when the host already contains node deployment artifacts. It is used by start before any bootstrap task mutates host state.

func EnsureNoExistingDeploymentFor ¶ added in v0.24.0

func EnsureNoExistingDeploymentFor(ctx context.Context, log *slog.Logger, mode isolation.Mode) error

EnsureNoExistingDeploymentFor is EnsureNoExistingDeployment for an isolation mode.

func HardenAPT ¶

func HardenAPT(log *slog.Logger) phases.Task

HardenAPT returns a task that writes drop-ins which prevent unattended-upgrades and needrestart from restarting systemd-machined (and thereby killing the running nspawn container). Idempotent.

func InstallPackages ¶

func InstallPackages(log *slog.Logger) phases.Task

InstallPackages returns a task that installs the required OS packages on the host.

func InstallPackagesFor ¶ added in v0.24.0

func InstallPackagesFor(log *slog.Logger, mode isolation.Mode) phases.Task

InstallPackagesFor is InstallPackages for an isolation mode. Modes other than nspawn do not require systemd-container.

func Preflight ¶ added in v0.1.20

func Preflight(log *slog.Logger, cfg config.AgentConfig, _ *goalstates.MachineGoalState) []preflight.Checker

Preflight returns the standard host environment checks required before provisioning an nspawn machine.

The mode comes from cfg. For nspawn the list is the one this package has always returned. For none the nspawn runtime check is replaced by the none backend's own preflight, which refuses a host that already runs a kubelet or containerd the agent does not own, or whose /etc, /opt or /var is read only, and the systemd-container package is not required. The kubelet and containerd "active" checks stay: they report the same conflict early with the check names operators already know.

func RemoveAPTHardening ¶ added in v0.24.0

func RemoveAPTHardening(log *slog.Logger) phases.Task

RemoveAPTHardening returns a task that removes the drop-ins HardenAPT writes. They exist only to keep a package upgrade from restarting systemd-machined under a running nspawn machine, so a mode without one removes them: they would otherwise hold back systemd and libcap security upgrades and disable needrestart for no reason. First-boot provisioning writes them for every mode, which is why bootstrap removes them rather than never writing them. Missing files are not an error.