Add target to transpile ignition userdata (#220)

metal-stack · Feb 25, 2025 · e541db0 · e541db0
1 parent 9ff7864
commit e541db0
Show file tree

Hide file tree

Showing 3 changed files with 46 additions and 8 deletions.
diff --git a/Makefile b/Makefile
@@ -1,6 +1,8 @@
 .DEFAULT_GOAL := up
 .EXPORT_ALL_VARIABLES:
 
+-include .env
+
 # Commands
 YQ=docker run --rm -i -v $(shell pwd):/workdir mikefarah/yq:4
 
@@ -163,13 +165,36 @@ cleanup-partition:
 _privatenet: env
 	docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl network list --name user-private-network | grep user-private-network || docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl network allocate --partition mini-lab --project 00000000-0000-0000-0000-000000000001 --name user-private-network
 
+.PHONY: update-userdata
+update-userdata:
+	cat files/ignition.yaml | docker run --rm -i ghcr.io/metal-stack/metal-deployment-base:$$DEPLOYMENT_BASE_IMAGE_TAG ct | jq > files/ignition.json
+
 .PHONY: machine
-machine: _privatenet
-	docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl machine create --description test --name test --hostname test --project 00000000-0000-0000-0000-000000000001 --partition mini-lab --image $(MACHINE_OS) --size v1-small-x86 --userdata "@/tmp/ignition.json" --networks $(shell docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl network list --name user-private-network -o template --template '{{ .id }}')
+machine: _privatenet update-userdata
+	docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl machine create \
+		--description test \
+		--name test \
+		--hostname test \
+		--project 00000000-0000-0000-0000-000000000001 \
+		--partition mini-lab \
+		--image $(MACHINE_OS) \
+		--size v1-small-x86 \
+		--userdata "@/tmp/ignition.json" \
+		--networks $(shell docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl network list --name user-private-network -o template --template '{{ .id }}')
 
 .PHONY: firewall
-firewall: _privatenet
-	docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl firewall create --description fw --name fw --hostname fw --project 00000000-0000-0000-0000-000000000001 --partition mini-lab --image firewall-ubuntu-3.0 --size v1-small-x86 --userdata "@/tmp/ignition.json" --firewall-rules-file=/tmp/rules.yaml --networks internet-mini-lab,$(shell docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl network list --name user-private-network -o template --template '{{ .id }}')
+firewall: _privatenet update-userdata
+	docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl firewall create \
+		--description fw \
+		--name fw \
+		--hostname fw \
+		--project 00000000-0000-0000-0000-000000000001 \
+		--partition mini-lab \
+		--image firewall-ubuntu-3.0 \
+		--size v1-small-x86 \
+		--userdata "@/tmp/ignition.json" \
+		--firewall-rules-file=/tmp/rules.yaml \
+		--networks internet-mini-lab,$(shell docker compose run $(DOCKER_COMPOSE_RUN_ARG) metalctl network list --name user-private-network -o template --template '{{ .id }}')
 
 .PHONY: public-ip
 public-ip:

diff --git a/files/ignition.json b/files/ignition.json
@@ -1,9 +1,11 @@
 {
   "ignition": {
     "config": {},
-    "security": {},
+    "security": {
+      "tls": {}
+    },
     "timeouts": {},
-    "version": "2.3.0"
+    "version": "2.2.0"
   },
   "networkd": {},
   "passwd": {},
@@ -14,10 +16,10 @@
         "path": "/etc/hosts.allow",
         "append": true,
         "contents": {
-          "source": "data:,ALL%3A%20%5Bfe80%3A%3A%5D%2F10%0AALL%3A%20203.0.113.1%0AALL%3A%20%5B2001%3Adb8%3A%3A1%5D%0A%0A",
+          "source": "data:,ALL%3A%20%5Bfe80%3A%3A%5D%2F10%0AALL%3A%20203.0.113.1%0AALL%3A%20%5B2001%3Adb8%3A%3A1%5D%0A",
           "verification": {}
         },
-        "mode": 644
+        "mode": 420
       }
     ]
   },

diff --git a/files/ignition.yaml b/files/ignition.yaml
@@ -0,0 +1,11 @@
+storage:
+  files:
+    - path: /etc/hosts.allow
+      filesystem: root
+      append: true
+      mode: 0644
+      contents:
+        inline: |
+          ALL: [fe80::]/10
+          ALL: 203.0.113.1
+          ALL: [2001:db8::1]