rootfs

func CheckCNIArtifacts ¶ added in v0.1.20

func CheckCNIArtifacts(log *slog.Logger, rootFS *goalstates.RootFS) preflight.Checker

CheckCNIArtifacts validates that CNI artifact URLs are reachable without downloading or extracting the full artifact.

func CheckCRIArtifacts ¶ added in v0.1.20

func CheckCRIArtifacts(log *slog.Logger, rootFS *goalstates.RootFS) preflight.Checker

CheckCRIArtifacts validates that CRI artifact URLs are reachable without downloading or extracting the full artifacts.

func CheckKubernetesArtifacts ¶ added in v0.1.20

func CheckKubernetesArtifacts(log *slog.Logger, rootFS *goalstates.RootFS) preflight.Checker

CheckKubernetesArtifacts validates that Kubernetes binary artifact URLs are reachable without downloading the full binaries or checksum files.

func CheckLocalDNSArtifact ¶ added in v0.2.3

func CheckLocalDNSArtifact(log *slog.Logger, rootFS *goalstates.RootFS) preflight.Checker

CheckLocalDNSArtifact validates that the selected CoreDNS artifact is reachable.

func CheckNSpawnMachineProvisioning ¶ added in v0.1.20

func CheckNSpawnMachineProvisioning(log *slog.Logger, gs *goalstates.RootFS) preflight.Checker

CheckNSpawnMachineProvisioning validates local host paths needed to provision and configure the nspawn machine rootfs.

func CheckOCIImageReachable ¶ added in v0.1.20

func CheckOCIImageReachable(_ *slog.Logger, rootFS *goalstates.RootFS) preflight.Checker

CheckOCIImageReachable validates that the OCI rootfs image source is reachable without pulling image contents.

func ConfigureLocalDNS ¶ added in v0.2.3

func ConfigureLocalDNS(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

ConfigureLocalDNS installs the CoreDNS binary and machine-local service configuration.

func ConfigureOS ¶

func ConfigureOS(goalState *goalstates.RootFS) phases.Task

ConfigureOS returns a task that writes OS-level configuration files into the machine rootfs so that kubelet and container networking work correctly inside systemd-nspawn. This includes an arch-specific apt sources.list so that packages can be installed inside the machine during the nodestart phase.

NOTE: The apt sources are hard-coded to Ubuntu Noble at this moment.

func DisableResolved ¶

func DisableResolved(goalState *goalstates.RootFS) phases.Task

DisableResolved returns a task that masks systemd-resolved inside the container and writes a static resolv.conf copied from the host.

The rootfs includes systemd-resolved which starts on boot and overwrites /etc/resolv.conf with "No DNS servers known." since it has no upstream configuration inside the container. By masking the service and writing a static file we avoid the conflict entirely. With VirtualEthernet=no the container shares the host network namespace, so the host's systemd-resolved stub at 127.0.0.53 is reachable.

NOTE: If we were building our own rootfs we could just ditch systemd-resolved entirely.

func DownloadCNIBinaries ¶

func DownloadCNIBinaries(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

DownloadCNIBinaries returns a task that downloads and installs CNI plugin binaries into the rootfs. It skips the download if all required plugins are already installed and the version matches.

func DownloadCRIBinaries ¶

func DownloadCRIBinaries(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

DownloadCRIBinaries returns a task that downloads and installs containerd and runc binaries into the rootfs. It skips each download if the installed version already matches.

func DownloadContainerImageArchives ¶ added in v0.1.21

func DownloadContainerImageArchives(_ *slog.Logger, staging *goalstates.ContainerImageArchiveStaging) phases.Task

DownloadContainerImageArchives returns a task that downloads container image archives into a host-side staging directory. The nspawn machine bind-mounts this directory read-only and imports these archives into containerd during node-start.

func DownloadKubeBinaries ¶

func DownloadKubeBinaries(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

DownloadKubeBinaries returns a task that downloads and installs Kubernetes node binaries into the rootfs. It skips the download if all required binaries are already installed and the kubelet version matches. Each binary is downloaded individually from the official Kubernetes release CDN (dl.k8s.io) and verified against its published SHA256 checksum.

func EnsureNSpawnConfig ¶ added in v0.2.4

func EnsureNSpawnConfig(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

EnsureNSpawnConfig returns a task that only writes the host-side systemd-nspawn configuration files for a machine. When the machine's hooks run the lifecycle helper and it is missing, it reinstalls the helper first, so the files it writes never run a helper that isn't there.

func EnsureNSpawnLifecycleHelper ¶ added in v0.2.4

func EnsureNSpawnLifecycleHelper() phases.Task

EnsureNSpawnLifecycleHelper installs a rollback-stable lifecycle command helper. Agent rollback changes the daemon's current symlink but leaves this helper in place so already-generated nspawn hooks remain executable. For a machine whose config may supply the hooks' commands, use EnsureNSpawnLifecycleHelperFor.

func EnsureNSpawnLifecycleHelperFor ¶ added in v0.17.0

func EnsureNSpawnLifecycleHelperFor(goalState *goalstates.RootFS) phases.Task

EnsureNSpawnLifecycleHelperFor is EnsureNSpawnLifecycleHelper for a machine. It installs nothing when the machine's hooks run configured commands instead of the helper.

func EnsureNSpawnWorkspace ¶

func EnsureNSpawnWorkspace(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

EnsureNSpawnWorkspace returns a task that bootstraps an OCI rootfs into the machine directory (if it is empty or missing) and writes the systemd-nspawn configuration files needed to run a Kubernetes node inside a nspawn container.

func InstallCoreDNS ¶ added in v0.24.0

func InstallCoreDNS(log *slog.Logger, goalState *goalstates.RootFS) phases.Task

InstallCoreDNS returns a task that downloads, verifies and installs only the CoreDNS binary, at the goal state root's LocalDNSCoreDNSBinaryPath. A host-native backend uses it to place the binary in its versioned directory and writes the unit and configuration itself.

func InstallHostRuntime ¶ added in v0.24.0

func InstallHostRuntime(log *slog.Logger, goalState *goalstates.RootFS, path string) phases.Task

InstallHostRuntime returns a task that installs the OCI runtime (runc) the container isolation backend uses to run the node container, at path on the host. It reuses the runc version and source the rootfs installers resolve, so a configured Runc version or download override applies to the host runtime as well as to the runc inside the node. The download is skipped when the installed runtime already reports the expected version, and an install replaces the file atomically so a running container's supervisor never sees a partial binary.

This is a host artifact: it is not placed under any node root.

func KubernetesModulesConfig ¶ added in v0.24.0

func KubernetesModulesConfig() []byte

KubernetesModulesConfig returns the modules-load.d content that lists the kernel modules the node needs. A host-native backend installs it on the host, where the nspawn machine would have loaded the same modules at boot.

func LocalDNSSupervisorScript ¶ added in v0.24.0

func LocalDNSSupervisorScript(coreDNSPath string) []byte

LocalDNSSupervisorScript returns the LocalDNS supervisor script with the CoreDNS binary path replaced by coreDNSPath, for a host-native backend that keeps the binary in a versioned directory.

func Preflight ¶ added in v0.1.20

func Preflight(log *slog.Logger, cfg config.AgentConfig, goalState *goalstates.MachineGoalState) []preflight.Checker

Preflight returns the standard rootfs checks for a resolved machine goal state.

The none mode installs the same release artifacts but has no OS image to pull and no machine to provision, so those two checks are left out for it. The container mode pulls the same OS image but provisions no nspawn machine, so only the machine check is left out for it; the container backend's own preflight (host phase) covers its directories.

func Provision ¶

func Provision(log *slog.Logger, gs *goalstates.RootFS) phases.Task

Provision returns a composite task that provisions a complete nspawn machine rootfs: bootstrapping the workspace, then downloading Kubernetes, CRI, and CNI binaries in parallel with OS configuration.

This is the shared rootfs provisioning sequence used by both the initial agent start and node update flows.

func ProvisionOwned ¶ added in v0.9.0

func ProvisionOwned(log *slog.Logger, gs *goalstates.RootFS) phases.Task

ProvisionOwned replays an initial bootstrap rootfs under established host ownership. Never use it for a slot that may have started a node.

func RepairNSpawnLifecycleHelper ¶ added in v0.17.0

func RepairNSpawnLifecycleHelper(goalState *goalstates.RootFS) phases.Task

RepairNSpawnLifecycleHelper installs the lifecycle helper if the machine's hooks run it and it is missing. EnsureNSpawnConfig runs it before writing the hooks, so a host whose config stops supplying the hooks' commands, which then installs no helper, gets the helper back rather than hooks that cannot run.