Skip to main content

Ubuntu HiL Host and K3s Setup

Prepare Ubuntu 22.04 or 24.04 and install one pinned, owned K3s node. Local compute readiness does not depend on VPN, Azure Arc, GPU support, storage integration, or access to the remote OSMO environment.

Prerequisites​

RequirementPurpose
Ubuntu 22.04 or 24.04 on x86_64 or ARM64Supported host and client packages
Repository checkoutPinned scripts and configuration
Root accessPackage, K3s binary, and systemd installation
Key Vault accessRetrieves the exact protected catalog and artifacts

Host preparation always installs Azure CLI for later device-code authentication and exact Key Vault transfer. Repository HiL scripts do not support SCP as a transfer path.

Prepare Ubuntu​

Preview host preparation:

data-pipeline/setup/hil/00-prepare-ubuntu.sh --config-preview

Prepare the host:

data-pipeline/setup/hil/00-prepare-ubuntu.sh

Host preparation installs the common Ubuntu packages, checksum-pinned Helm and OSMO clients, and Azure CLI. It does not authenticate, access Key Vault, discover Azure resources, or change remote state.

Install Local K3s​

Preview the local compute target:

data-pipeline/setup/hil/01-install-k3s.sh \
  --node-name <host-name> \
  --config-preview

Install or verify the owned cluster:

data-pipeline/setup/hil/01-install-k3s.sh \
  --node-name <host-name>

The script:

  • Verifies the selected Pod and Service CIDRs do not overlap
  • Refuses kubeadm, MicroK8s, unmanaged K3s, unmanaged kubelet, and unmanaged CNI state
  • Verifies the pinned K3s binary before installation
  • Writes one root-owned ownership marker and exact K3s configuration
  • Creates one current-user kubeconfig with mode 0600
  • Verifies the explicit context, node identity, version, and readiness

Rerunning the same target verifies owned state. A changed or foreign target stops before mutation.

Choose Reachability​

Skip VPN when the environment's approved OSMO endpoint and Key Vault are already reachable. Local K3s remains ready in either case.

When private routing is required, follow the optional VPN section in Ubuntu HiL OSMO Backend. The VPN sequence uses exact public inputs, keeps the Ubuntu private key on the host, and has a visible stop for private-only Key Vault restoration before connection.

Next Step​

Have the environment owner publish the host-bound HiL inputs, then continue with Ubuntu HiL OSMO Backend.

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.