wip: add custom k3s image

.github/workflows/image-test.yml

@@ -0,0 +1,27 @@
+name: Test UDS Capability
+
+on:
+  pull_request:
+    paths:
+      - "docker/**"
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  test-clean-install:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup UDS
+        if: always()
+        uses: defenseunicorns/uds-common/.github/actions/[email protected]
+        with:
+          username: ${{secrets.IRON_BANK_ROBOT_USERNAME}}
+          password: ${{secrets.IRON_BANK_ROBOT_PASSWORD}}
+
+      - name: Create and deploy the uds-k3d package
+        run: uds run build-image

.github/workflows/build-test.yml → .github/workflows/k3d-test.yml

@@ -20,11 +20,13 @@ jobs:
 
       - name: Setup UDS
         if: always()
-        uses: defenseunicorns/uds-common/.github/actions/[email protected]
+        uses: defenseunicorns/uds-common/.github/actions/[email protected]
+        with:
+          username: ${{secrets.IRON_BANK_ROBOT_USERNAME}}
+          password: ${{secrets.IRON_BANK_ROBOT_PASSWORD}}
 
       - name: Create and deploy the uds-k3d package
         run: uds run
 
       - name: Validate uds-k3d package
         run: uds run validate
-

.github/workflows/tag-and-release.yml

@@ -34,7 +34,10 @@ jobs:
 
       - name: Setup UDS
         if: always()
-        uses: defenseunicorns/uds-common/.github/actions/[email protected]
+        uses: defenseunicorns/uds-common/.github/actions/[email protected]
+        with:
+          username: ${{secrets.IRON_BANK_ROBOT_USERNAME}}
+          password: ${{secrets.IRON_BANK_ROBOT_PASSWORD}}
 
       - name: Login to GHCR
         uses: docker/login-action@v3
@@ -47,3 +50,6 @@ jobs:
         run: |
           uds zarf package create --confirm -a arm64 -o oci://ghcr.io/defenseunicorns/packages
           uds zarf package create --confirm -a amd64 -o oci://ghcr.io/defenseunicorns/packages
+
+      - name: Publish the custom k3s image
+        run: uds run publish-image

docker/Dockerfile

@@ -0,0 +1,5 @@
+ARG K3S_TAG="v1.28.7-k3s1"
+
+FROM rancher/k3s:$K3S_TAG as k3s
+
+COPY config.toml.tmpl /var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl

docker/config.toml.tmpl

@@ -0,0 +1,26 @@
+version = 2
+
+[plugins."io.containerd.internal.v1.opt"]
+  path = "/var/lib/rancher/k3s/agent/containerd"
+[plugins."io.containerd.grpc.v1.cri"]
+  stream_server_address = "127.0.0.1"
+  stream_server_port = "10010"
+  enable_selinux = false
+  enable_unprivileged_ports = true
+  enable_unprivileged_icmp = true
+  sandbox_image = "rancher/mirrored-pause:3.6"
+
+[plugins."io.containerd.grpc.v1.cri".containerd]
+  snapshotter = "overlayfs"
+  disable_snapshot_annotations = true
+
+[plugins."io.containerd.grpc.v1.cri".cni]
+  bin_dir = "/bin"
+  conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d"
+
+
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+  runtime_type = "io.containerd.runc.v2"
+
+[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
+  SystemdCgroup = false

tasks.yaml

@@ -1,3 +1,7 @@
+variables:
+  - name: K3S_VERSION
+    default: "v1.28.7-k3s1"
+
 tasks:
   - name: default
     description: "Build and deploy uds-k3d"
@@ -27,3 +31,14 @@ tasks:
             echo "CoreDNS patch failed, foo.uds.dev is resolving to 127.0.0.1"
             exit 1
           fi
+
+  - name: build-image
+    actions:
+      - description: Build the custom k3s image
+        cmd: docker build -t ghcr.io/defenseunicorns/oss/uds-k3d-k3s:${K3S_VERSION} --build-arg K3S_TAG=${K3S_VERSION} docker/
+
+  - name: publish-image 
+    actions:
+      - task: build-image
+      - description: Publish the custom k3s image
+        cmd: docker push ghcr.io/defenseunicorns/oss/uds-k3d-k3s:${K3S_VERSION}

zarf.yaml

@@ -17,7 +17,7 @@ variables:
 
   - name: K3D_IMAGE
     description: "K3d image to use"
-    default: "rancher/k3s:v1.27.4-k3s1"
+    default: "rancher/k3s:v1.28.7-k3s1"
 
   - name: K3D_EXTRA_ARGS
     description: "Optionally pass k3d arguments to the default"