primary.yaml

passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - "YOUR_KEY_HERE"

storage:

  files:
      # TODO(mcsaucy): this is sad. Stop doing this.
    - path: "/etc/selinux/config"
      contents:
        inline: "SELINUX=permissive\nSELINUXTYPE=targeted"
      mode: 0644
      overwrite: true
    - path: "/etc/zincati/config.d/51-rollout-wariness.toml"
      contents:
        inline: |
          [identity]
          rollout_wariness = 0.1
      mode: 0644
    - path: "/etc/hostname"
      contents:
          local: hostname
      mode: 0644
    - path: "/opt/bin/k3s"
      contents:
        remote:
            url: "https://github.com/rancher/k3s/releases/download/v1.18.6%2Bk3s1/k3s"
            verification:
                hash:
                    function: sha512
                    sum: 0951e378d9d1525386e3bc5e067d8f256fe4aed16a5827850736ac223cb211213c48278dacf440694715c045673b583647ef0eb9fcf576dd4cc04685e56ee1f5
      mode: 0755
      user:
        name: root
      group:
        name: root
    - path: "/secrets/k3s_token"
      contents:
          local: k3s_token
      mode: 0400
      user:
        name: root
      group:
        name: root

systemd:
  units:

    - name: k3s.service
      enabled: true
      contents: |
        [Unit]
        Description=Lightweight Kubernetes
        Documentation=https://k3s.io
        After=network-online.target

        [Install]
        WantedBy=multi-user.target

        [Service]
        Type=notify
        KillMode=process
        Delegate=yes
        LimitNOFILE=1048576
        LimitNPROC=infinity
        LimitCORE=infinity
        TasksMax=infinity
        TimeoutStartSec=0
        Restart=always
        RestartSec=5s
        ExecStartPre=-/sbin/modprobe br_netfilter
        ExecStartPre=-/sbin/modprobe overlay
        ExecStart=/opt/bin/k3s --debug server \
          --cluster-init \
          --cluster-domain example.com \
          --token-file /secrets/k3s_token