$ ssh [email protected] 'hostnamectl; free -m | head -2; nproc'
 Static hostname: srv-tramontana-proves
  Operating System: Ubuntu 24.04.1 LTS
            Kernel: Linux 6.8.0-41-generic
               total        used        free
Mem:            3891         412        3102
2

$ virt-install --name k8s-node2 --memory 2048 --vcpus 2 --disk size=20 \
    --cloud-init user-data=cloud-init-node2.yaml \
    --os-variant ubuntu24.04 --import --noautoconsole
$ virsh domifaddr k8s-node2
 vnet2  52:54:00:a1:b2:c4  ipv4  192.168.122.105/24

# ===== NODE SERVIDOR: srv-tramontana-proves (192.168.122.104) =====
$ ssh [email protected]

# Descarregar i REVISAR l script abans d executar-lo. Canalitzar un URL
# directament a sh es exactament el que 05-03 desaconsella.
$ curl -sfL https://get.k3s.io -o /tmp/k3s-install.sh
$ sha256sum /tmp/k3s-install.sh
$ less /tmp/k3s-install.sh

$ INSTALL_K3S_VERSION="v1.30.4+k3s1" \
  INSTALL_K3S_EXEC="server \
      --write-kubeconfig-mode 0644 \
      --disable traefik=false \
      --node-label rol=servidor \
      --tls-san 192.168.122.104" \
  sh /tmp/k3s-install.sh
[INFO]  Using v1.30.4+k3s1 as release
[INFO]  systemd: Starting k3s

$ sudo systemctl status k3s --no-pager | head -4
● k3s.service - Lightweight Kubernetes
     Active: active (running) since Tue 2026-08-18 15:02:11 CEST

# El testimoni que autentica els nodes que s uneixin. Es un secret real:
# amb ell, qualsevol pot unir un node al cluster.
$ sudo cat /var/lib/rancher/k3s/server/node-token
K10a3f19c8d::server:8f2b1c4d5e6a7b8c9d0e1f2a3b4c5d6e

# ===== NODE AGENT: k8s-node2 (192.168.122.105) =====
$ ssh [email protected]
$ curl -sfL https://get.k3s.io -o /tmp/k3s-install.sh
$ INSTALL_K3S_VERSION="v1.30.4+k3s1" \
  K3S_URL="https://192.168.122.104:6443" \
  K3S_TOKEN="K10a3f19c8d::server:8f2b1c4d5e6a7b8c9d0e1f2a3b4c5d6e" \
  INSTALL_K3S_EXEC="agent --node-label rol=treball" \
  sh /tmp/k3s-install.sh

# ===== Verificacio, des del servidor =====
$ sudo k3s kubectl get nodes -o wide
NAME                    STATUS   ROLES                  AGE   VERSION        INTERNAL-IP
srv-tramontana-proves   Ready    control-plane,master   4m    v1.30.4+k3s1   192.168.122.104
k8s-node2               Ready    <none>                 1m    v1.30.4+k3s1   192.168.122.105

$ sudo k3s kubectl get pods -A
NAMESPACE     NAME                                     READY   STATUS      RESTARTS
kube-system   coredns-6799fbcd5-x8k2p                  1/1     Running     0
kube-system   local-path-provisioner-6c86858495-mn4qt  1/1     Running     0
kube-system   metrics-server-54fd9b65b-7jc9d           1/1     Running     0
kube-system   svclb-traefik-4a1b2c3d-p9k4m             2/2     Running     0
kube-system   traefik-7d764994d8-lm2xw                 1/1     Running     0

$ sudo k3s kubectl top nodes
NAME                    CPU(cores)   CPU%   MEMORY(bytes)   MEMORY%
srv-tramontana-proves   142m         7%     812Mi           21%
k8s-node2               38m          1%     284Mi           14%

# Des del teu portatil, sense dependre de sudo al servidor
$ sudo apt install kubernetes-client   # o descarregar el binari oficial
$ mkdir -p ~/.kube
$ scp [email protected]:/etc/rancher/k3s/k3s.yaml ~/.kube/config-proves
$ sed -i 's/127.0.0.1/192.168.122.104/' ~/.kube/config-proves
$ chmod 0600 ~/.kube/config-proves
$ export KUBECONFIG=~/.kube/config-proves

# ~/.kube/config-proves (fragment)
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBD...   # la CA del cluster
    server: https://192.168.122.104:6443
  name: default
users:
- name: default
  user:
    client-certificate-data: LS0tLS1CRUdJTiBD...      # el teu certificat
    client-key-data: LS0tLS1CRUdJTiBS...              # LA TEVA CLAU PRIVADA
contexts:
- context: {cluster: default, user: default, namespace: tramontana}
  name: proves
current-context: proves

$ kubectl get nodes
NAME                    STATUS   ROLES                  AGE   VERSION
srv-tramontana-proves   Ready    control-plane,master   12m   v1.30.4+k3s1
k8s-node2               Ready    <none>                 9m    v1.30.4+k3s1

# Autocompletat i un alies: es fa servir dotzenes de vegades al dia
$ echo 'source <(kubectl completion bash)' >> ~/.bashrc
$ echo 'alias k=kubectl; complete -o default -F __start_kubectl k' >> ~/.bashrc

$ kubectl run prova --image=nginx:1.27-alpine --restart=Never
$ kubectl get pod prova -o wide
NAME    READY   STATUS    RESTARTS   AGE   IP           NODE
prova   1/1     Running   0          8s    10.42.1.14   k8s-node2

$ kubectl delete pod prova
$ kubectl get pods
No resources found.

Deployment  →  gestiona ReplicaSets (un per versió)  →  creen Pods

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 1          # quants Pods DE MES hi pot haver temporalment
    maxUnavailable: 0    # quants de MENYS. 0 = capacitat integra sempre

<servei>.<namespace>.svc.cluster.local

$ kubectl run dns-test --rm -it --image=busybox:1.36 --restart=Never -- \
      nslookup tramontana.tramontana.svc.cluster.local
Server:    10.43.0.10
Address:   10.43.0.10:53
Name:      tramontana.tramontana.svc.cluster.local
Address:   10.43.112.88

$ kubectl create secret generic prova --from-literal=password='SuperSecreta123'
$ kubectl get secret prova -o jsonpath='{.data.password}' | base64 -d; echo
SuperSecreta123

$ kubectl get storageclass
NAME                   PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE
local-path (default)   rancher.io/local-path   Delete          WaitForFirstConsumer

# ~/tramontana-k8s/00-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: tramontana
  labels:
    # Pod Security Standards (apartat 10): rebutja Pods privilegiats
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
---
# Quota: impedeix que un error de configuracio consumeixi el cluster sencer
apiVersion: v1
kind: ResourceQuota
metadata:
  name: quota-tramontana
  namespace: tramontana
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 2Gi
    limits.cpu: "4"
    limits.memory: 4Gi
    persistentvolumeclaims: "4"

# ~/tramontana-k8s/10-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: tramontana-config
  namespace: tramontana
data:
  # Es el /etc/tramontana/app.conf de sempre, com a objecte del cluster
  db_host: "10.0.2.15"
  db_port: "6432"              # PgBouncer (08-02)
  db_name: "tramontana"
  max_connexions: "80"
  timeout_consulta: "30"
  log_nivell: "info"
  escolta: "0.0.0.0"           # dins del Pod, no de l amfitrio
  port: "8080"
---
apiVersion: v1
kind: Secret
metadata:
  name: tramontana-secrets
  namespace: tramontana
type: Opaque
stringData:
  # stringData permet escriure en clar i Kubernetes ho codifica sol.
  # AQUEST FITXER NO VA A GIT. En produccio, Sealed Secrets o Vault.
  db_password: "MARCADOR_S_INJECTA_DES_DE_PASS"

# A la practica, el Secret es crea sense fitxer intermedi:
$ kubectl -n tramontana create secret generic tramontana-secrets \
      --from-literal=db_password="$(pass tramontana/db)" \
      --dry-run=client -o yaml | kubectl apply -f -

# ~/tramontana-k8s/20-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tramontana
  namespace: tramontana
  labels:
    app: tramontana
spec:
  replicas: 2
  revisionHistoryLimit: 5        # quants ReplicaSets vells cal conservar
  selector:
    matchLabels:
      app: tramontana

  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1                # un de mes durant el desplegament
      maxUnavailable: 0          # MAI menys capacitat de la declarada

  template:
    metadata:
      labels:
        app: tramontana
        version: "3.2.1"
    spec:
      # Repartir les repliques entre nodes diferents: si un node cau,
      # no se n van les dues alhora.
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: tramontana

      # --- Seguretat a nivell de Pod (apartat 10) ---
      securityContext:
        runAsNonRoot: true
        runAsUser: 997             # svc-tramontana, l uid de sempre
        runAsGroup: 1002           # grup tramontana
        fsGroup: 1002
        seccompProfile:
          type: RuntimeDefault

      containers:
        - name: tramontana
          image: registre.tramontana.example/tramontana:3.2.1
          # MAI ':latest'. Una etiqueta mobil fa que dos Pods de la
          # mateixa "versio" executin codi diferent, i que una marxa
          # enrere no torni enlloc.
          imagePullPolicy: IfNotPresent

          ports:
            - name: http
              containerPort: 8080

          # --- Configuracio des del ConfigMap ---
          envFrom:
            - configMapRef:
                name: tramontana-config
          env:
            - name: TRAMONTANA_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: tramontana-secrets
                  key: db_password

          # --- Recursos: la relacio amb els cgroups de 07-05 ---
          # requests: el que el PLANIFICADOR reserva per triar node.
          # limits:   el sostre real, imposat per cgroups v2.
          #   - Superar el limit de MEMORIA -> el nucli MATA el
          #     contenidor (OOMKilled): es un limit dur.
          #   - Superar el de CPU -> s ESTRANGULA (throttling), no es
          #     mata: el proces simplement va mes lent.
          resources:
            requests:
              cpu: 100m            # 0,1 nucli
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi

          # --- Les tres sondes, i cadascuna respon a una cosa diferent ---

          # startupProbe: "ha acabat d arrencar?" Mentre falla,
          # les altres dues NO s executen. Es el que permet arrencades
          # lentes sense relaxar el liveness. 30 x 5 s = 150 s de marge.
          startupProbe:
            httpGet: {path: /salut, port: http}
            periodSeconds: 5
            failureThreshold: 30

          # readinessProbe: "pot atendre peticions ARA?"
          # Si falla, el Pod SURT del Service (deixa de rebre transit)
          # pero NO es reinicia. Es la porta del balancejador.
          readinessProbe:
            httpGet: {path: /salut, port: http}
            periodSeconds: 5
            timeoutSeconds: 2
            successThreshold: 1
            failureThreshold: 3

          # livenessProbe: "es viu o penjat?" Si falla, el kubelet
          # MATA I REINICIA el contenidor. Per aixo es la mes perillosa:
          # mal calibrada, provoca reinicis en cascada sota carrega.
          # Llindars MES LAXOS que els de readiness, sempre.
          livenessProbe:
            httpGet: {path: /salut, port: http}
            periodSeconds: 15
            timeoutSeconds: 3
            failureThreshold: 5

          # --- Seguretat a nivell de contenidor ---
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]

          # Amb readOnlyRootFilesystem cal donar lloc escrivible
          # explicit per al que de debo ho necessiti.
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: cache
              mountPath: /var/cache/tramontana

          # Tancament ordenat: dona temps a acabar les peticions en
          # curs abans que arribi el SIGTERM.
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 5"]

      terminationGracePeriodSeconds: 30
      volumes:
        - name: tmp
          emptyDir: {sizeLimit: 64Mi}
        - name: cache
          emptyDir: {sizeLimit: 256Mi}

# ~/tramontana-k8s/30-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: tramontana
  namespace: tramontana
spec:
  type: ClusterIP
  selector:
    app: tramontana            # les etiquetes del Pod, no del Deployment
  ports:
    - name: http
      port: 80                 # port del Service
      targetPort: http         # port amb nom del contenidor
---
# La base de dades viu FORA del cluster (srv-tramontana). Aquest objecte
# li dona un nom intern, de manera que l aplicacio faci servir sempre
# "postgresql" i no una IP codificada.
apiVersion: v1
kind: Service
metadata:
  name: postgresql
  namespace: tramontana
spec:
  type: ExternalName
  externalName: srv-tramontana.intern

# ~/tramontana-k8s/40-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tramontana
  namespace: tramontana
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
    # Les capcaleres de seguretat de 08-01, com a anotacions
    traefik.ingress.kubernetes.io/router.middlewares: tramontana-seguretat@kubernetescrd
spec:
  ingressClassName: traefik
  tls:
    - hosts: [reserves.tramontana.example]
      secretName: tramontana-tls      # Secret de tipus kubernetes.io/tls
  rules:
    - host: reserves.tramontana.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: tramontana
                port: {name: http}
---
# Middleware de Traefik: l equivalent dels add_header de 08-01
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: seguretat
  namespace: tramontana
spec:
  headers:
    stsSeconds: 63072000
    stsIncludeSubdomains: true
    contentTypeNosniff: true
    frameDeny: true
    referrerPolicy: "strict-origin-when-cross-origin"

# El certificat de 06-05, com a Secret
$ sudo kubectl -n tramontana create secret tls tramontana-tls \
      --cert=/etc/letsencrypt/live/reserves.tramontana.example/fullchain.pem \
      --key=/etc/letsencrypt/live/reserves.tramontana.example/privkey.pem

# Desplegar-ho tot, en ordre
$ kubectl apply -f ~/tramontana-k8s/
namespace/tramontana created
resourcequota/quota-tramontana created
configmap/tramontana-config created
deployment.apps/tramontana created
service/tramontana created
ingress.networking.k8s.io/tramontana created

$ kubectl -n tramontana get pods -o wide
NAME                          READY   STATUS    RESTARTS   AGE   NODE
tramontana-7d8f9c4b5-k2m4p    1/1     Running   0          48s   srv-tramontana-proves
tramontana-7d8f9c4b5-x9n7q    1/1     Running   0          48s   k8s-node2

$ kubectl -n tramontana get endpoints tramontana
NAME         ENDPOINTS                           AGE
tramontana   10.42.0.18:8080,10.42.1.22:8080     51s

# 1. Desplegar la versio 3.3.0. --record esta obsolet; es fa servir una
#    anotacio perque quedi constancia del motiu.
$ kubectl -n tramontana set image deployment/tramontana \
      tramontana=registre.tramontana.example/tramontana:3.3.0
$ kubectl -n tramontana annotate deployment/tramontana \
      kubernetes.io/change-cause="Versio 3.3.0: informes optimitzats"

# 2. Seguir-ho en directe
$ kubectl -n tramontana rollout status deployment/tramontana
Waiting for deployment "tramontana" rollout to finish: 1 out of 2 new replicas have been updated...
Waiting for deployment "tramontana" rollout to finish: 1 old replicas are pending termination...
deployment "tramontana" successfully rolled out

# 3. Durant el proces conviuen tots dos ReplicaSets
$ kubectl -n tramontana get rs
NAME                    DESIRED   CURRENT   READY   AGE
tramontana-7d8f9c4b5    0         0         0       18m    # 3.2.1
tramontana-9f2a1c8e7    2         2         2       42s    # 3.3.0

# 4. La versio nova falla en produccio: marxa enrere
$ kubectl -n tramontana rollout history deployment/tramontana
REVISION  CHANGE-CAUSE
1         Versio 3.2.1 inicial
2         Versio 3.3.0: informes optimitzats

$ kubectl -n tramontana rollout undo deployment/tramontana
deployment.apps/tramontana rolled back

$ kubectl -n tramontana rollout status deployment/tramontana
deployment "tramontana" successfully rolled out

# 5. Escalar, que es trivial i per aixo crida l atencio
$ kubectl -n tramontana scale deployment/tramontana --replicas=4
$ kubectl -n tramontana get pods --no-headers | wc -l
4

# Verificar que s aplica de debo
$ kubectl -n tramontana exec deploy/tramontana -- id
uid=997 gid=1002 groups=1002
$ kubectl -n tramontana exec deploy/tramontana -- touch /prova
touch: /prova: Read-only file system
command terminated with exit code 1

# ~/tramontana-k8s/50-networkpolicy.yaml
# 1. Denegar-HO TOT per defecte al namespace (llista blanca, 06-03)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: denegar-tot
  namespace: tramontana
spec:
  podSelector: {}                # tots els Pods del namespace
  policyTypes: [Ingress, Egress]
---
# 2. Permetre nomes el que cal
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: permetre-tramontana
  namespace: tramontana
spec:
  podSelector:
    matchLabels: {app: tramontana}
  policyTypes: [Ingress, Egress]
  ingress:
    # Nomes des de l Ingress (Traefik viu a kube-system)
    - from:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
      ports: [{protocol: TCP, port: 8080}]
  egress:
    # DNS: sense aixo, RES no funciona i la fallada desconcerta
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    # PostgreSQL, fora del cluster
    - to:
        - ipBlock: {cidr: 10.0.2.15/32}
      ports: [{protocol: TCP, port: 6432}]

# Luis: nomes lectura i registres al seu namespace. No pot veure Secrets.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: tramontana
  name: lector
rules:
  - apiGroups: ["", "apps"]
    resources: ["pods", "pods/log", "deployments", "services", "configmaps"]
    verbs: ["get", "list", "watch"]
  # 'secrets' NO hi apareix: llegir-los es llegir les contrasenyes (base64)

# Comprovar permisos, propis o d un altre
$ kubectl auth can-i get secrets -n tramontana --as=luis
no
$ kubectl auth can-i get pods -n tramontana --as=luis
yes

$ kubectl -n tramontana run dolent --image=nginx --privileged
Error from server (Forbidden): pods "dolent" is forbidden: violates PodSecurity
"restricted:latest": privileged (container "dolent" must not set
securityContext.privileged=true), allowPrivilegeEscalation != false,
unrestricted capabilities, runAsNonRoot != true, seccompProfile

$ kubectl -n tramontana describe pod tramontana-7d8f9c4b5-k2m4p | tail -12
Events:
  Type     Reason     Age                From     Message
  ----     ------     ----               ----     -------
  Normal   Scheduled  2m                 default-scheduler  Successfully assigned...
  Normal   Pulling    2m                 kubelet  Pulling image "...:3.2.1"
  Normal   Pulled     1m                 kubelet  Successfully pulled image
  Normal   Created    1m                 kubelet  Created container tramontana
  Normal   Started    1m                 kubelet  Started container tramontana
  Warning  Unhealthy  30s (x3 over 40s)  kubelet  Readiness probe failed:
             Get "http://10.42.0.18:8080/salut": dial tcp: connect: connection refused

$ kubectl -n tramontana get pods
NAME                         READY   STATUS             RESTARTS      AGE
tramontana-9f2a1c8e7-p4k9m   0/1     CrashLoopBackOff   5 (48s ago)   4m

# La clau: --previous. Sense ella veus els registres de l intent ACTUAL,
# que acaba d arrencar i esta buit.
$ kubectl -n tramontana logs tramontana-9f2a1c8e7-p4k9m --previous
FATAL: no s ha pogut connectar a la base de dades: password authentication
failed for user "svc_tramontana"

# Confirmar la causa
$ kubectl -n tramontana get secret tramontana-secrets -o jsonpath='{.data.db_password}' \
      | base64 -d | head -c8; echo '...'
MARCADOR...

$ kubectl -n tramontana describe pod tramontana-x | grep -A3 Events
  Warning  Failed  30s  kubelet  Failed to pull image
    "registre.tramontana.example/tramontana:3.3.1": failed to resolve reference:
    unexpected status: 401 Unauthorized

$ kubectl -n tramontana describe pod tramontana-y | tail -4
  Warning  FailedScheduling  20s  default-scheduler
    0/2 nodes are available: 1 Insufficient cpu, 1 Insufficient memory.
    preemption: 0/2 nodes are available: 2 No preemption victims found.

# Quant hi ha realment compromes a cada node
$ kubectl describe node k8s-node2 | grep -A6 'Allocated resources'
Allocated resources:
  Resource   Requests      Limits
  cpu        1750m (87%)   3200m (160%)
  memory     1894Mi (94%)  2560Mi (128%)

$ kubectl -n tramontana describe pod tramontana-z | grep -A4 'Last State'
    Last State:     Terminated
      Reason:       OOMKilled
      Exit Code:    137            # 128 + 9 (SIGKILL)

# Esdeveniments del namespace, en ordre cronologic
$ kubectl -n tramontana get events --sort-by=.lastTimestamp | tail -10

# Consum real (necessita metrics-server, que k3s porta)
$ kubectl -n tramontana top pods
NAME                         CPU(cores)   MEMORY(bytes)
tramontana-7d8f9c4b5-k2m4p   12m          184Mi

# Depurar la xarxa des de dins del cluster, sense tocar els Pods reals
$ kubectl -n tramontana run depurar --rm -it --image=nicolaka/netshoot \
      --restart=Never -- bash
depurar:~# nslookup tramontana
depurar:~# curl -sv http://tramontana/salut
depurar:~# nc -zv 10.0.2.15 6432

# Reenviar un port al portatil, sense exposar res
$ kubectl -n tramontana port-forward svc/tramontana 8080:80
$ curl -s localhost:8080/salut

# ~/tramontana-infra/roles/k3s/defaults/main.yml
---
k3s_version: "v1.30.4+k3s1"
k3s_url: "https://192.168.122.104:6443"
k3s_magatzem: sqlite
k3s_deshabilitar: []
k3s_extra_args_servidor: "--write-kubeconfig-mode 0644 --tls-san {{ ansible_default_ipv4.address }}"

# ~/tramontana-infra/roles/k3s/tasks/main.yml
---
- name: Guardia de seguretat — MAI en produccio
  ansible.builtin.assert:
    that: inventory_hostname != 'srv-tramontana'
    fail_msg: >-
      Aquest rol NO s ha d executar a srv-tramontana. k3s reescriu les
      regles de nftables i arrenca el seu propi entorn d execucio de
      contenidors; al servidor de produccio interferiria amb ufw,
      AppArmor i el servei tramontana.

- name: Requisits del sistema
  ansible.builtin.apt:
    name: [curl, iptables, apparmor-utils]
    state: present

- name: Descarregar l instal·lador de k3s
  ansible.builtin.get_url:
    url: https://get.k3s.io
    dest: /usr/local/src/k3s-install.sh
    mode: '0755'

- name: Instal·lar k3s al node SERVIDOR
  ansible.builtin.command:
    cmd: /usr/local/src/k3s-install.sh
    creates: /usr/local/bin/k3s        # idempotencia (07-06)
  environment:
    INSTALL_K3S_VERSION: "{{ k3s_version }}"
    INSTALL_K3S_EXEC: "server {{ k3s_extra_args_servidor }}"
  when: "'k3s_servidor' in group_names"

- name: Llegir el testimoni del node servidor
  ansible.builtin.slurp:
    src: /var/lib/rancher/k3s/server/node-token
  register: k3s_token_raw
  when: "'k3s_servidor' in group_names"

- name: Compartir el testimoni amb els agents
  ansible.builtin.set_fact:
    k3s_token: "{{ hostvars[groups['k3s_servidor'][0]]['k3s_token_raw']['content'] | b64decode | trim }}"
  no_log: true

- name: Instal·lar k3s als nodes AGENT
  ansible.builtin.command:
    cmd: /usr/local/src/k3s-install.sh
    creates: /usr/local/bin/k3s
  environment:
    INSTALL_K3S_VERSION: "{{ k3s_version }}"
    K3S_URL: "{{ k3s_url }}"
    K3S_TOKEN: "{{ k3s_token }}"
    INSTALL_K3S_EXEC: "agent"
  no_log: true
  when: "'k3s_agent' in group_names"

- name: Esperar que el node estigui Ready
  ansible.builtin.command: "k3s kubectl get node {{ ansible_hostname }} -o json"
  register: node
  until: >-
    (node.stdout | from_json).status.conditions
    | selectattr('type','eq','Ready') | map(attribute='status') | first == 'True'
  retries: 30
  delay: 10
  changed_when: false
  delegate_to: "{{ groups['k3s_servidor'][0] }}"

# --- Copia de seguretat del cluster, que es el que de debo importa ---
- name: Instal·lar l script de copia d etcd/SQLite
  ansible.builtin.copy:
    src: copia_k3s.sh
    dest: /usr/local/bin/copia_k3s.sh
    mode: '0750'
  when: "'k3s_servidor' in group_names"

- name: Temporitzador diari de copia de l estat del cluster
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/etc/systemd/system/{{ item }}"
    mode: '0644'
  loop: [copia-k3s.service, copia-k3s.timer]
  notify: Recarregar systemd
  when: "'k3s_servidor' in group_names"

# roles/k3s/files/copia_k3s.sh (nucli)
$ k3s etcd-snapshot save --name diari           # amb etcd
# o, amb SQLite:
$ sqlite3 /var/lib/rancher/k3s/server/db/state.db ".backup '/srv/backups/k3s.db'"
$ restic backup /srv/backups/k3s.db --tag k3s

$ sudo kubeadm certs check-expiration | head -5
CERTIFICATE                EXPIRES                  RESIDUAL TIME
apiserver                  Aug 18, 2027 13:02 UTC   364d
etcd-server                Aug 18, 2027 13:02 UTC   364d

$ kubectl -n tramontana get pods
NAME                          READY   STATUS             RESTARTS      AGE
tramontana-7d8f9c4b5-k2m4p    1/1     Running            0             3h    # 3.2.1
tramontana-9f2a1c8e7-p4k9m    0/1     CrashLoopBackOff   4 (52s ago)   3m    # 3.3.0

$ kubectl -n tramontana rollout status deployment/tramontana --timeout=10s
error: timed out waiting for the condition

$ kubectl -n tramontana get endpoints tramontana
NAME         ENDPOINTS          AGE
tramontana   10.42.0.18:8080    3h

$ kubectl -n tramontana logs tramontana-9f2a1c8e7-p4k9m --previous
[2026-08-18T16:02:11Z] INFO  Tramontana Reserves 3.3.0 iniciant
[2026-08-18T16:02:11Z] INFO  llegint configuracio de l entorn
[2026-08-18T16:02:11Z] ERROR variable TRAMONTANA_CACHE_URL no definida
[2026-08-18T16:02:11Z] FATAL configuracio incompleta; avortant

$ kubectl -n tramontana describe pod tramontana-9f2a1c8e7-p4k9m | \
      grep -A6 'Last State'
    Last State:     Terminated
      Reason:       Error
      Exit Code:    1              # NO es 137: no es OOMKilled
      Started:      Tue, 18 Aug 2026 16:02:11 +0200
      Finished:     Tue, 18 Aug 2026 16:02:11 +0200

$ kubectl -n tramontana get configmap tramontana-config -o jsonpath='{.data}' | \
      jq 'keys'
["db_host","db_name","db_port","escolta","log_nivell","max_connexions",
 "port","timeout_consulta"]

$ kubectl -n tramontana rollout undo deployment/tramontana
deployment.apps/tramontana rolled back
$ kubectl -n tramontana rollout status deployment/tramontana
deployment "tramontana" successfully rolled out

$ kubectl -n tramontana patch configmap tramontana-config \
      --type merge -p '{"data":{"cache_url":"redis://cache.tramontana.svc:6379"}}'

# 20-deployment.yaml — el mapatge explicit de la variable
          env:
            - name: TRAMONTANA_CACHE_URL
              valueFrom:
                configMapKeyRef:
                  name: tramontana-config
                  key: cache_url

# Verificar en un Pod exhaurible ABANS de tocar el Deployment
$ kubectl -n tramontana run verificar --rm -it --restart=Never \
      --image=registre.tramontana.example/tramontana:3.3.0 \
      --overrides='{"spec":{"containers":[{"name":"verificar",
        "image":"registre.tramontana.example/tramontana:3.3.0",
        "envFrom":[{"configMapRef":{"name":"tramontana-config"}}],
        "env":[{"name":"TRAMONTANA_CACHE_URL","valueFrom":
          {"configMapKeyRef":{"name":"tramontana-config","key":"cache_url"}}}]}]}}' \
      -- /usr/bin/tramontana --check-config
configuracio valida

# Ara si
$ kubectl apply -f ~/tramontana-k8s/20-deployment.yaml
$ kubectl -n tramontana rollout status deployment/tramontana
deployment "tramontana" successfully rolled out
$ kubectl -n tramontana get pods
NAME                          READY   STATUS    RESTARTS   AGE
tramontana-3c7e9a2b1-h4j8k    1/1     Running   0          42s
tramontana-3c7e9a2b1-w2n5r    1/1     Running   0          28s

$ kubectl -n tramontana rollout restart deployment/tramontana

# ~/tramontana-k8s/60-cronjob-copia.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: copia-basedades
  namespace: tramontana
spec:
  # 02:30, igual que tramontana-copia.timer (05-05).
  # COMPTE: l horari s interpreta a la ZONA HORARIA DEL CLUSTER, que
  # per defecte es UTC. timeZone (estable des de 1.27) ho resol; sense
  # ella, la copia s executaria a les 04:30 a l estiu.
  schedule: "30 2 * * *"
  timeZone: "Europe/Madrid"

  # L equivalent del flock de 04-07: si la copia d ahir continua
  # corrent, NO se n llanca una altra a sobre.
  concurrencyPolicy: Forbid

  # Si el cluster va estar caigut a les 02:30, s executa en tornar?
  # 3600 = nomes si ha passat menys d 1 h. Es l equivalent de
  # Persistent=true del temporitzador, pero ACOTAT: sense aquest camp,
  # un Job molt endarrerit es llancaria en un moment inoportu.
  startingDeadlineSeconds: 3600

  successfulJobsHistoryLimit: 7    # conservar 7 execucions correctes
  failedJobsHistoryLimit: 14       # i 14 de fallides: son les que es miren

  jobTemplate:
    spec:
      # Reintents davant de fallada, amb espera exponencial
      backoffLimit: 2
      # Sostre absolut: una copia penjada no bloqueja la seguent
      activeDeadlineSeconds: 3600
      # Neteja automatica del Job 3 dies despres
      ttlSecondsAfterFinished: 259200

      template:
        spec:
          restartPolicy: OnFailure

          securityContext:
            runAsNonRoot: true
            runAsUser: 997
            runAsGroup: 1002
            fsGroup: 1002
            seccompProfile: {type: RuntimeDefault}

          containers:
            - name: copia
              image: registre.tramontana.example/copia:1.4.0
              command: ["/usr/local/bin/copia_tramontana.sh"]

              env:
                - name: PGHOST
                  valueFrom:
                    configMapKeyRef: {name: tramontana-config, key: db_host}
                - name: PGDATABASE
                  valueFrom:
                    configMapKeyRef: {name: tramontana-config, key: db_name}
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef: {name: tramontana-secrets, key: db_password}
                - name: RESTIC_REPOSITORY
                  valueFrom:
                    secretKeyRef: {name: restic-secrets, key: repositori}
                - name: RESTIC_PASSWORD
                  valueFrom:
                    secretKeyRef: {name: restic-secrets, key: password}

              resources:
                requests: {cpu: 100m, memory: 256Mi}
                # La copia comprimeix: necessita mes folganca que l app
                limits:   {cpu: "1",  memory: 1Gi}

              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities: {drop: ["ALL"]}

              volumeMounts:
                - {name: treball, mountPath: /tmp}
                - {name: cache-restic, mountPath: /var/cache/restic}

          volumes:
            - name: treball
              emptyDir: {sizeLimit: 4Gi}
            # La memoria cau de restic accelera molt les copies
            # successives: persistir-la entre execucions es una
            # optimitzacio real.
            - name: cache-restic
              persistentVolumeClaim: {claimName: cache-restic}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cache-restic
  namespace: tramontana
spec:
  accessModes: [ReadWriteOnce]
  resources: {requests: {storage: 2Gi}}

# Provar SENSE esperar a les 02:30 (equivalent a systemctl start)
$ kubectl -n tramontana create job --from=cronjob/copia-basedades prova-manual
$ kubectl -n tramontana logs job/prova-manual -f
[2026-08-18 17:12:03] iniciant copia de PostgreSQL
[2026-08-18 17:12:41] copia base verificada: 1,7 GiB
[2026-08-18 17:14:12] restic: instantania a3f19c8d desada
[2026-08-18 17:14:20] copia completada

$ kubectl -n tramontana get cronjob
NAME              SCHEDULE     TIMEZONE        SUSPEND   ACTIVE   LAST SCHEDULE
copia-basedades   30 2 * * *   Europe/Madrid   False     0        8h