From f6a747affb97fce45a06158f36e1fe09d3dd0421 Mon Sep 17 00:00:00 2001
From: Stensel8 <102481635+Stensel8@users.noreply.github.com>
Date: Thu, 17 Sep 2026 09:10:14 +0200
Subject: [PATCH 1/2] fix: harden K3s and kubeadm installers and sync with
 DevOps-Security

K3s:
- give the sudo user's group read access to the kubeconfig (0640), so
  kubectl works without sudo on the control plane
- worker: check /ping on the API before installing, and wait for the
  kubelet client cert instead of reporting success right away
- explain that kubectl does not work on a worker node

k8s_installer.sh is now a kubeadm cluster installer at the same level as
the K3s one (control plane / worker, --url/--token/--ca-cert-hash,
reachability check, pinned kubeadm/kubelet/kubectl and Flannel, node
Ready wait, kubectl for the sudo user). It replaces the kubectl +
minikube client installer.

Both scripts are byte-identical to kubernetes/install-k3s.sh and
kubernetes/install-k8s.sh in Stensel8/DevOps-Security. Renovate now tracks
Flannel instead of minikube.
---
 CONTRIBUTING.md             |   2 +-
 kubernetes/k3s_installer.sh |  79 +++++--
 kubernetes/k8s_installer.sh | 409 ++++++++++++++++++++++++++----------
 renovate.json               |   6 +-
 4 files changed, 369 insertions(+), 127 deletions(-)
 mode change 100644 => 100755 kubernetes/k8s_installer.sh

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f5c702d..d6ac1a4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -10,7 +10,7 @@ This repository uses Renovate plus a few GitHub Actions workflows to keep depend
 Automatically monitors and creates PRs for:
 - GitHub Actions updates
 - The `TLS-tools/testssl.sh` git submodule
-- Hardcoded versions in installer scripts (NGINX and its modules, Ansible, kubectl, minikube, Vagrant) via custom regex managers
+- Hardcoded versions in installer scripts (NGINX and its modules, Ansible, Kubernetes, Flannel, K3s, Vagrant) via custom regex managers
 
 **Important:** the custom regex managers match exact variable formats such as
 `NGINX_VERSION="1.31.1"` (bash) and `$Script:NGINX_VERSION = '1.31.1'`
diff --git a/kubernetes/k3s_installer.sh b/kubernetes/k3s_installer.sh
index 3cf25b0..852459b 100755
--- a/kubernetes/k3s_installer.sh
+++ b/kubernetes/k3s_installer.sh
@@ -7,6 +7,13 @@
 # so it works on any systemd-based Linux without a distro package manager.
 # Kubernetes role names are used (control plane / worker); K3s' own
 # "server / agent" wording is mapped internally.
+#
+#   Control plane:  sudo ./<script> --control-plane
+#   Worker:         sudo ./<script> --worker \
+#                       --url https://<control-plane-ip>:6443 --token <token>
+#
+# This file is kept identical in THectic-NL/Scripts (kubernetes/k3s_installer.sh)
+# and Stensel8/DevOps-Security (kubernetes/install-k3s.sh); change both.
 # Run as root.
 #
 
@@ -99,9 +106,12 @@ Invoke-Cmd() {
 # Usage
 # ============================================================================
 
+# Name as invoked, so help and join hints match however the file was saved.
+SCRIPT_NAME=$(basename "$0")
+
 Show-Usage() {
-    cat <<'EOF'
-Usage: k3s_installer.sh <role> [options]
+    cat <<EOF
+Usage: ${SCRIPT_NAME} <role> [options]
 
 Roles:
   --control-plane   Install the first K3s node (control plane)
@@ -119,8 +129,8 @@ After a --control-plane install the summary prints the join value and the
 exact --worker command to run on the other nodes.
 
 Examples:
-  sudo ./k3s_installer.sh --control-plane
-  sudo ./k3s_installer.sh --worker --url https://10.0.0.1:6443 --token K10abc...
+  sudo ./${SCRIPT_NAME} --control-plane
+  sudo ./${SCRIPT_NAME} --worker --url https://10.0.0.1:6443 --token K10abc...
 EOF
 }
 
@@ -136,10 +146,20 @@ K3S_VERSION="${K3S_VERSION:-v1.37.0+k3s1}"
 Install-ControlPlane() {
     Write-Log INFO "Installing K3s ${K3S_VERSION} (control plane)"
 
+    # The kubeconfig is root-only by default, so 'kubectl' fails for the sudo
+    # user. Hand it to that user's group (0640) instead of making it world-
+    # readable; the flags end up in the unit, so they survive k3s restarts.
+    local kube_user="${SUDO_USER:-}" kube_group=""
+    local -a server_args=(server)
+    if [[ -n "$kube_user" && "$kube_user" != root ]]; then
+        kube_group=$(id -gn "$kube_user")
+        server_args+=(--write-kubeconfig-mode 0640 --write-kubeconfig-group "$kube_group")
+    fi
+
     # get.k3s.io is Rancher's official install path; it is a remote script.
     Write-Log WARN "Fetching and running the official installer from https://get.k3s.io"
     curl -sfL https://get.k3s.io | \
-        INSTALL_K3S_VERSION="$K3S_VERSION" sh -s - server >> "$LOG_FILE" 2>&1 || \
+        INSTALL_K3S_VERSION="$K3S_VERSION" sh -s - "${server_args[@]}" >> "$LOG_FILE" 2>&1 || \
         Stop-Script "K3s install failed. Check log: $LOG_FILE"
     Invoke-Cmd systemctl enable k3s
 
@@ -149,7 +169,7 @@ Install-ControlPlane() {
         k3s kubectl get node 2>/dev/null | grep -q ' Ready ' && break
         sleep 2
     done
-    k3s kubectl get node || Write-Log WARN "Node not Ready yet; re-check with 'k3s kubectl get node'."
+    k3s kubectl get node || Write-Log WARN "Node not Ready yet; re-check with 'sudo kubectl get node'."
 
     local node_ip node_join k3s_ver
     node_ip=$(hostname -I | awk '{print $1}')
@@ -160,13 +180,25 @@ Install-ControlPlane() {
     Write-Log SUCCESS "K3s control plane ready!"
     echo -e "${GREEN}==============================================================${NC}\n"
     echo -e "${BLUE}K3s:${NC}          ${GREEN}${k3s_ver}${NC}"
-    echo -e "${BLUE}kubeconfig:${NC}   ${GREEN}/etc/rancher/k3s/k3s.yaml${NC}"
+    echo -e "${BLUE}API URL:${NC}      ${GREEN}https://${node_ip}:6443${NC}"
+    echo -e "${BLUE}kubeconfig:${NC}   ${GREEN}/etc/rancher/k3s/k3s.yaml${NC}${kube_group:+ (readable by group ${kube_group})}"
     echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
     echo ""
-    echo -e "${BLUE}Join a worker:${NC}"
-    echo -e "  sudo ./k3s_installer.sh --worker --url https://${node_ip}:6443 --token ${node_join:-(see /var/lib/rancher/k3s/server/node-token)}"
+    echo -e "${BOLD}Join a worker (run on each worker node)${NC}"
+    echo -e "  sudo ./${SCRIPT_NAME} --worker \\"
+    echo -e "      --url https://${node_ip}:6443 --token ${node_join:-(see /var/lib/rancher/k3s/server/node-token)}"
     echo ""
-    echo -e "${BLUE}Use kubectl:${NC}  export KUBECONFIG=/etc/rancher/k3s/k3s.yaml   # or: k3s kubectl ..."
+    if [[ -n "$kube_group" ]]; then
+        echo -e "${BOLD}Use kubectl (as ${kube_user}, no sudo needed)${NC}"
+        echo -e "  kubectl get nodes"
+    else
+        echo -e "${BOLD}Use kubectl${NC}"
+        echo -e "  sudo kubectl get nodes"
+    fi
+    echo ""
+    echo -e "${YELLOW}Cloud/firewall:${NC} nodes must reach each other on TCP 6443, TCP 10250 and"
+    echo -e "     UDP 8472 (on AWS: a self-referencing 'All traffic' security group rule),"
+    echo -e "     plus inbound on any NodePort you expose (30000-32767)."
 }
 
 # Usage: Install-Worker <server-url-or-ip> <join-value>
@@ -178,6 +210,12 @@ Install-Worker() {
     [[ "$url" == https://* ]] || url="https://${url}:6443"
     [[ "$join" =~ ^[A-Za-z0-9:._-]+$ ]] || Stop-Script "The --token value has unexpected characters."
 
+    # Fail fast when the API port is unreachable (on AWS: security group).
+    # /ping is served unauthenticated by the K3s supervisor and returns "pong".
+    Write-Log INFO "Checking that ${url} is reachable..."
+    curl -ksf --max-time 5 "${url}/ping" 2>/dev/null | grep -q pong || \
+        Stop-Script "Cannot reach ${url}/ping. Check the URL, that K3s runs on the control plane, and that the security group allows TCP 6443 from this node."
+
     Write-Log INFO "Installing K3s ${K3S_VERSION} (worker), joining ${url}"
 
     # get.k3s.io is Rancher's official install path; it is a remote script.
@@ -188,6 +226,19 @@ Install-Worker() {
         Stop-Script "K3s agent install failed. Check log: $LOG_FILE"
     Invoke-Cmd systemctl enable k3s-agent
 
+    # The installer returns as soon as the service starts, not when the join
+    # succeeds. The kubelet client cert is only issued after the server accepts
+    # the token, so its presence means the node registered.
+    Write-Log INFO "Waiting for the control plane to accept this node..."
+    local _ joined=false
+    for _ in $(seq 1 30); do
+        if [[ -s /var/lib/rancher/k3s/agent/client-kubelet.crt ]]; then
+            joined=true; break
+        fi
+        sleep 2
+    done
+    $joined || Stop-Script "Agent did not join within 60s. Inspect: journalctl -u k3s-agent -n 50 (wrong token, or UDP 8472 / TCP 10250 blocked?)"
+
     local k3s_ver
     k3s_ver=$(k3s --version 2>/dev/null | head -n1) || k3s_ver="N/A"
 
@@ -198,7 +249,11 @@ Install-Worker() {
     echo -e "${BLUE}Joined:${NC}       ${GREEN}${url}${NC}"
     echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
     echo ""
-    echo -e "${BLUE}Verify:${NC}       k3s kubectl get node   # run on the control plane"
+    echo -e "${BOLD}Verify on the control plane${NC}"
+    echo -e "  kubectl get nodes        # this node should be Ready within ~30s"
+    echo ""
+    echo -e "${YELLOW}Note:${NC} kubectl does not work on a worker (no kubeconfig here, so it"
+    echo -e "      falls back to localhost:8080). Manage the cluster from the control plane."
 }
 
 # ============================================================================
@@ -237,7 +292,7 @@ Test-Root
 
 if command -v k3s &>/dev/null; then
     Write-Log WARN "K3s is already installed: $(k3s --version | head -n1)"
-    Write-Log INFO "Remove it with k3s-uninstall.sh or k3s-agent-uninstall.sh first."
+    Write-Log INFO "Remove it first: k3s-uninstall.sh (control plane) or k3s-agent-uninstall.sh (worker)."
     exit 0
 fi
 
diff --git a/kubernetes/k8s_installer.sh b/kubernetes/k8s_installer.sh
old mode 100644
new mode 100755
index ef52e04..795efec
--- a/kubernetes/k8s_installer.sh
+++ b/kubernetes/k8s_installer.sh
@@ -1,10 +1,19 @@
 #!/usr/bin/env bash
 #
-# Kubernetes (kubectl) Installer Script
+# Kubernetes (kubeadm) Installer Script
 #
-# Installs kubectl on Debian/Ubuntu (apt), RHEL/Fedora/CentOS (dnf) and
-# Arch Linux (pacman, via a checksum-verified binary download).
-# Optionally installs minikube.
+# Builds an upstream Kubernetes cluster with kubeadm, containerd and the
+# Flannel CNI. Both roles get the same node prep (swap off, kernel modules,
+# sysctl, containerd, pinned kubeadm/kubelet/kubectl); --control-plane then
+# runs "kubeadm init" + Flannel, --worker runs "kubeadm join".
+#
+#   Control plane:  sudo ./<script> --control-plane
+#   Worker:         sudo ./<script> --worker --url <control-plane-ip>:6443 \
+#                       --token <token> --ca-cert-hash sha256:<hash>
+#
+# Targets Ubuntu/Debian. For other systemd distros use the K3s installer.
+# This file is kept identical in THectic-NL/Scripts (kubernetes/k8s_installer.sh)
+# and Stensel8/DevOps-Security (kubernetes/install-k8s.sh); change both.
 # Run as root.
 #
 
@@ -93,123 +102,301 @@ Invoke-Cmd() {
     fi
 }
 
+# ============================================================================
+# Usage
+# ============================================================================
+
+# Name as invoked, so help and join hints match however the file was saved.
+SCRIPT_NAME=$(basename "$0")
+
+Show-Usage() {
+    cat <<USAGE
+Usage: ${SCRIPT_NAME} <role> [options]
+
+Roles:
+  --control-plane       Prep the node, run "kubeadm init" and install Flannel
+  --worker              Prep the node and join an existing cluster as a worker
+
+Options (worker):
+  --url HOST[:PORT]     Control-plane API endpoint; port defaults to 6443
+                        (an https:// prefix is accepted and stripped)
+  --token VALUE         Bootstrap token from the control plane (valid 24h)
+  --ca-cert-hash VALUE  sha256:<hash> of the cluster CA
+
+Other:
+  -h, --help            Show this help
+
+After a --control-plane install the summary prints the exact --worker command
+to run on the other nodes. Expired token? On the control plane run:
+  sudo kubeadm token create --print-join-command
+
+Targets Ubuntu/Debian.
+
+Examples:
+  sudo ./${SCRIPT_NAME} --control-plane
+  sudo ./${SCRIPT_NAME} --worker --url 10.0.0.1:6443 \\
+      --token abcdef.0123456789abcdef --ca-cert-hash sha256:1234...
+USAGE
+}
+
 # === Settings ===
 LOG_FILE="/tmp/k8s_install_$(date +%Y%m%d_%H%M%S).log"
 
+# Pinned releases (Renovate-managed).
 K8S_VERSION="${K8S_VERSION:-v1.37.0}"
-MINIKUBE_VERSION="${MINIKUBE_VERSION:-v1.39.0}"
-# pkgs.k8s.io repos are per minor version (v1.36), not per patch release.
+FLANNEL_VERSION="${FLANNEL_VERSION:-v0.28.9}"
+
+# pkgs.k8s.io repos are per minor version (v1.37); the patch release is pinned
+# through the package version (1.37.0-*).
 K8S_CHANNEL="${K8S_VERSION%.*}"
-APT_BASE_URL="https://pkgs.k8s.io/core:/stable:/${K8S_CHANNEL}/deb/"
-RPM_BASE_URL="https://pkgs.k8s.io/core:/stable:/${K8S_CHANNEL}/rpm/"
+K8S_APT_URL="https://pkgs.k8s.io/core:/stable:/${K8S_CHANNEL}/deb/"
+K8S_PKG_VERSION="${K8S_VERSION#v}-*"
+POD_CIDR="${POD_CIDR:-10.244.0.0/16}"
+FLANNEL_MANIFEST="https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml"
 
-# === Root check ===
-Test-Root
+export DEBIAN_FRONTEND=noninteractive
 
-# === kubectl already installed? ===
-if command -v kubectl &>/dev/null; then
-    Write-Log WARN "kubectl is already installed: $(kubectl version --client --short 2>/dev/null || kubectl version --client)"
-    exit 0
-fi
+# === Commands ===
 
-Write-Log INFO "Installing kubectl ${K8S_VERSION} (channel ${K8S_CHANNEL})..."
-
-# === Install kubectl ===
-PKG_MANAGER=$(Get-PkgMgr)
-case $PKG_MANAGER in
-    apt)
-        Write-Log INFO "APT-based system detected."
-
-        Invoke-Cmd apt-get update -y
-        Invoke-Cmd apt-get install -y apt-transport-https ca-certificates curl gnupg
-
-        install -d -m 755 /etc/apt/keyrings
-        curl -fsSL "${APT_BASE_URL}Release.key" | \
-            gpg --dearmour -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg 2>>"$LOG_FILE" || \
-            Stop-Script "Failed to download Kubernetes signing key."
-        chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
-
-        echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] ${APT_BASE_URL} /" \
-            > /etc/apt/sources.list.d/kubernetes.list
-        chmod 644 /etc/apt/sources.list.d/kubernetes.list
-
-        Invoke-Cmd apt-get update -y
-        Invoke-Cmd apt-get install -y kubectl
-        ;;
-
-    dnf)
-        Write-Log INFO "DNF-based system detected."
-
-        cat > /etc/yum.repos.d/kubernetes.repo <<EOF
-[kubernetes]
-name=Kubernetes
-baseurl=${RPM_BASE_URL}
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=${RPM_BASE_URL}repodata/repomd.xml.key
-exclude=kube*
-EOF
-
-        Invoke-Cmd dnf install -y kubectl --disableexcludes=kubernetes
-        ;;
-
-    pacman)
-        # No pkgs.k8s.io repo for Arch; install the pinned binary directly,
-        # verified against its published checksum (same pattern as minikube).
-        Write-Log INFO "Pacman-based system detected. Installing kubectl as a verified binary."
-
-        KUBECTL_ARCH=$(uname -m)
-        case "$KUBECTL_ARCH" in
-            x86_64)  KUBECTL_ARCH="amd64" ;;
-            aarch64) KUBECTL_ARCH="arm64" ;;
-            *)       Stop-Script "Unsupported architecture for kubectl: ${KUBECTL_ARCH}" ;;
-        esac
-
-        KUBECTL_URL="https://dl.k8s.io/release/${K8S_VERSION}/bin/linux/${KUBECTL_ARCH}/kubectl"
-        curl -fSL "${KUBECTL_URL}" -o kubectl 2>>"$LOG_FILE" || Stop-Script "Failed to download kubectl."
-        curl -fSL "${KUBECTL_URL}.sha256" -o kubectl.sha256 2>>"$LOG_FILE" || Stop-Script "Failed to download kubectl checksum."
-        echo "$(cat kubectl.sha256)  kubectl" | sha256sum -c - >>"$LOG_FILE" 2>&1 || Stop-Script "kubectl checksum verification failed."
-        install kubectl /usr/local/bin/kubectl
-        rm -f kubectl kubectl.sha256
-        ;;
-
-    *)
-        Stop-Script "Unsupported system. Only Debian/Ubuntu (apt), RHEL/Fedora/CentOS (dnf) and Arch Linux (pacman) are supported."
-        ;;
-esac
+# Usage: Initialize-Node
+# Shared node prep for both roles. No-op if kubeadm is already installed.
+Initialize-Node() {
+    if command -v kubeadm &>/dev/null; then
+        Write-Log WARN "kubeadm already installed ($(kubeadm version -o short 2>/dev/null)); skipping node prep."
+        return 0
+    fi
+
+    local distro codename
+    distro=$(Get-OsId)
+    # shellcheck disable=SC1091
+    codename=$(. /etc/os-release && echo "${VERSION_CODENAME:-}")
+
+    Write-Log STEP "Disabling swap"
+    swapoff -a
+    sed -i.bak '/\sswap\s/s/^\(.*\)$/#\1/' /etc/fstab
+
+    Write-Log STEP "Loading kernel modules (overlay, br_netfilter)"
+    cat > /etc/modules-load.d/k8s.conf <<CONF
+overlay
+br_netfilter
+CONF
+    modprobe overlay
+    modprobe br_netfilter
+
+    Write-Log STEP "Applying sysctl settings"
+    cat > /etc/sysctl.d/k8s.conf <<CONF
+net.bridge.bridge-nf-call-iptables  = 1
+net.bridge.bridge-nf-call-ip6tables = 1
+net.ipv4.ip_forward                 = 1
+CONF
+    sysctl --system >> "$LOG_FILE" 2>&1
+
+    # containerd.io ships from the Docker apt repo; Docker itself is not installed.
+    Write-Log STEP "Installing containerd"
+    Invoke-Cmd apt-get update -y
+    Invoke-Cmd apt-get install -y ca-certificates curl gnupg
+
+    install -d -m 0755 /etc/apt/keyrings
+    curl -fsSL "https://download.docker.com/linux/${distro}/gpg" | \
+        gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg 2>>"$LOG_FILE" || \
+        Stop-Script "Failed to add the Docker GPG key."
+    chmod a+r /etc/apt/keyrings/docker.gpg
+
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
+https://download.docker.com/linux/${distro} ${codename} stable" \
+        > /etc/apt/sources.list.d/docker.list
+
+    Invoke-Cmd apt-get update -y
+    Invoke-Cmd apt-get install -y containerd.io
+
+    # kubelet uses the systemd cgroup driver; containerd must match or pods
+    # restart in a loop. Fail loudly if the default config layout changed.
+    Write-Log INFO "Configuring containerd with the systemd cgroup driver"
+    mkdir -p /etc/containerd
+    containerd config default > /etc/containerd/config.toml
+    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
+    grep -q 'SystemdCgroup = true' /etc/containerd/config.toml || \
+        Stop-Script "Could not enable SystemdCgroup in /etc/containerd/config.toml."
+    Invoke-Cmd systemctl restart containerd
+    Invoke-Cmd systemctl enable containerd
+
+    Write-Log STEP "Installing kubeadm/kubelet/kubectl ${K8S_VERSION}"
+    curl -fsSL "${K8S_APT_URL}Release.key" | \
+        gpg --dearmor --yes -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg 2>>"$LOG_FILE" || \
+        Stop-Script "Failed to download the Kubernetes signing key."
+    chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
+
+    echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] ${K8S_APT_URL} /" \
+        > /etc/apt/sources.list.d/kubernetes.list
+    chmod 644 /etc/apt/sources.list.d/kubernetes.list
+
+    Invoke-Cmd apt-get update -y
+    Invoke-Cmd apt-get install -y "kubelet=${K8S_PKG_VERSION}" "kubeadm=${K8S_PKG_VERSION}" "kubectl=${K8S_PKG_VERSION}"
+    apt-mark hold kubelet kubeadm kubectl >> "$LOG_FILE" 2>&1
+
+    Invoke-Cmd systemctl enable --now kubelet
+}
+
+# Usage: Install-ControlPlane
+Install-ControlPlane() {
+    Initialize-Node
+
+    Write-Log STEP "Running kubeadm init (${K8S_VERSION}, pod CIDR ${POD_CIDR})"
+    kubeadm init --kubernetes-version "${K8S_VERSION}" --pod-network-cidr="${POD_CIDR}" >> "$LOG_FILE" 2>&1 || \
+        Stop-Script "kubeadm init failed. Check log: $LOG_FILE (reset with 'sudo kubeadm reset -f' before retrying)"
+
+    # admin.conf is root-only. Give root and the sudo user their own copy, so
+    # both 'kubectl' and 'sudo kubectl' work.
+    local kube_user="${SUDO_USER:-root}" kube_home
+    kube_home=$(getent passwd "$kube_user" | cut -d: -f6)
+    install -d -m 0700 /root/.kube
+    install -m 0600 /etc/kubernetes/admin.conf /root/.kube/config
+    if [[ "$kube_user" != root ]]; then
+        install -d -m 0700 -o "$kube_user" -g "$(id -gn "$kube_user")" "${kube_home}/.kube"
+        install -m 0600 -o "$kube_user" -g "$(id -gn "$kube_user")" /etc/kubernetes/admin.conf "${kube_home}/.kube/config"
+    fi
+    export KUBECONFIG=/etc/kubernetes/admin.conf
+
+    Write-Log STEP "Installing the Flannel CNI ${FLANNEL_VERSION}"
+    Invoke-Cmd kubectl apply -f "${FLANNEL_MANIFEST}"
+
+    # The node only turns Ready once the CNI is up.
+    Write-Log INFO "Waiting for the node to become Ready..."
+    local _
+    for _ in $(seq 1 60); do
+        kubectl get node 2>/dev/null | grep -q ' Ready ' && break
+        sleep 2
+    done
+    kubectl get node || Write-Log WARN "Node not Ready yet; re-check with 'kubectl get node'."
+
+    # Split the join line into the worker flags this script takes.
+    local join_line endpoint join_token ca_hash kubeadm_ver
+    join_line=$(kubeadm token create --print-join-command 2>>"$LOG_FILE") || \
+        Stop-Script "Could not create a join token. Check log: $LOG_FILE"
+    endpoint=$(awk '{print $3}' <<< "$join_line")
+    join_token=$(awk '{for (i = 1; i < NF; i++) if ($i == "--token") print $(i + 1)}' <<< "$join_line")
+    ca_hash=$(awk '{for (i = 1; i < NF; i++) if ($i == "--discovery-token-ca-cert-hash") print $(i + 1)}' <<< "$join_line")
+    kubeadm_ver=$(kubeadm version -o short 2>/dev/null) || kubeadm_ver="N/A"
+
+    echo -e "\n${GREEN}==============================================================${NC}"
+    Write-Log SUCCESS "Kubernetes control plane ready!"
+    echo -e "${GREEN}==============================================================${NC}\n"
+    echo -e "${BLUE}kubeadm:${NC}      ${GREEN}${kubeadm_ver}${NC}"
+    echo -e "${BLUE}API URL:${NC}      ${GREEN}https://${endpoint}${NC}"
+    echo -e "${BLUE}kubeconfig:${NC}   ${GREEN}${kube_home}/.kube/config${NC}"
+    echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
+    echo ""
+    echo -e "${BOLD}Join a worker (run on each worker node; token valid 24h)${NC}"
+    echo -e "  sudo ./${SCRIPT_NAME} --worker --url ${endpoint} \\"
+    echo -e "      --token ${join_token} \\"
+    echo -e "      --ca-cert-hash ${ca_hash}"
+    echo ""
+    echo -e "${BOLD}Use kubectl${NC}"
+    echo -e "  kubectl get nodes"
+    echo ""
+    echo -e "${YELLOW}Cloud/firewall:${NC} nodes must reach each other on TCP 6443, TCP 10250 and"
+    echo -e "     UDP 8472 (on AWS: a self-referencing 'All traffic' security group rule),"
+    echo -e "     plus inbound on any NodePort you expose (30000-32767)."
+}
+
+# Usage: Install-Worker <endpoint> <token> <ca-cert-hash>
+Install-Worker() {
+    local endpoint=$1 join_token=$2 ca_hash=$3
+
+    [[ -n "$endpoint"   ]] || Stop-Script "Worker needs --url <control-plane-ip>:6443"
+    [[ -n "$join_token" ]] || Stop-Script "Worker needs --token <token from the control plane>"
+    [[ -n "$ca_hash"    ]] || Stop-Script "Worker needs --ca-cert-hash sha256:<hash from the control plane>"
+    endpoint=${endpoint#https://}
+    endpoint=${endpoint%/}
+    [[ "$endpoint" == *:* ]] || endpoint="${endpoint}:6443"
+    [[ "$endpoint" =~ ^[A-Za-z0-9.-]+:[0-9]+$ ]] || Stop-Script "The --url value should look like 10.0.0.1:6443."
+    [[ "$join_token" =~ ^[a-z0-9]{6}\.[a-z0-9]{16}$ ]] || Stop-Script "The --token value should look like abcdef.0123456789abcdef."
+    [[ "$ca_hash" =~ ^sha256:[a-f0-9]{64}$ ]] || Stop-Script "The --ca-cert-hash value should look like sha256:<64 hex chars>."
+
+    # Fail fast, before installing anything, when the API port is unreachable
+    # (on AWS: security group). /livez is readable without credentials.
+    Write-Log INFO "Checking that https://${endpoint} is reachable..."
+    curl -ksf --max-time 5 "https://${endpoint}/livez" 2>/dev/null | grep -q ok || \
+        Stop-Script "Cannot reach https://${endpoint}/livez. Check the URL, that the control plane is up, and that the security group allows TCP 6443 from this node."
+
+    Initialize-Node
+
+    # kubeadm join only returns after the kubelet's TLS bootstrap succeeded,
+    # so a zero exit means the node registered. Not using Invoke-Cmd: it would
+    # print the token.
+    Write-Log STEP "Joining the cluster at ${endpoint}"
+    kubeadm join "$endpoint" --token "$join_token" --discovery-token-ca-cert-hash "$ca_hash" >> "$LOG_FILE" 2>&1 || \
+        Stop-Script "kubeadm join failed. Check log: $LOG_FILE (expired token? reset with 'sudo kubeadm reset -f' before retrying)"
+    systemctl is-active --quiet kubelet || \
+        Write-Log WARN "kubelet is not active; inspect: journalctl -u kubelet -n 50"
+
+    local kubeadm_ver
+    kubeadm_ver=$(kubeadm version -o short 2>/dev/null) || kubeadm_ver="N/A"
+
+    echo -e "\n${GREEN}==============================================================${NC}"
+    Write-Log SUCCESS "Kubernetes worker joined!"
+    echo -e "${GREEN}==============================================================${NC}\n"
+    echo -e "${BLUE}kubeadm:${NC}      ${GREEN}${kubeadm_ver}${NC}"
+    echo -e "${BLUE}Joined:${NC}       ${GREEN}https://${endpoint}${NC}"
+    echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
+    echo ""
+    echo -e "${BOLD}Verify on the control plane${NC}"
+    echo -e "  kubectl get nodes        # this node turns Ready once Flannel runs on it"
+    echo ""
+    echo -e "${YELLOW}Note:${NC} kubectl does not work on a worker (no kubeconfig here, so it"
+    echo -e "      falls back to localhost:8080). Manage the cluster from the control plane."
+}
 
-Write-Log SUCCESS "kubectl installed: $(kubectl version --client --short 2>/dev/null || kubectl version --client)"
-
-# === Minikube (optional) ===
-echo ""
-read -rp "Install minikube as well? (y/n): " install_minikube
-if [[ "$install_minikube" == "y" ]]; then
-    Write-Log INFO "Installing minikube..."
-    ARCH=$(uname -m)
-    case "$ARCH" in
-        x86_64)  MINIKUBE_BIN="minikube-linux-amd64" ;;
-        aarch64) MINIKUBE_BIN="minikube-linux-arm64" ;;
-        *)       Stop-Script "Unsupported architecture for minikube: ${ARCH}" ;;
+# ============================================================================
+# Main Entry Point
+# ============================================================================
+
+ROLE=""
+SERVER_URL=""
+JOIN_VALUE=""
+CA_HASH=""
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --control-plane)
+            ROLE="control-plane"; shift ;;
+        --worker)
+            ROLE="worker"; shift ;;
+        --url)
+            SERVER_URL=${2:-}
+            [[ -n "$SERVER_URL" ]] || Stop-Script "--url requires a value"
+            shift 2 ;;
+        --token)
+            JOIN_VALUE=${2:-}
+            [[ -n "$JOIN_VALUE" ]] || Stop-Script "--token requires a value"
+            shift 2 ;;
+        --ca-cert-hash)
+            CA_HASH=${2:-}
+            [[ -n "$CA_HASH" ]] || Stop-Script "--ca-cert-hash requires a value"
+            shift 2 ;;
+        -h|--help)
+            Show-Usage; exit 0 ;;
+        *)
+            Write-Log ERROR "Unknown argument: $1"; Show-Usage; exit 1 ;;
     esac
+done
+
+Test-Root
+[[ -d /run/systemd/system ]] || Stop-Script "kubeadm requires a systemd-based system."
 
-    MINIKUBE_URL="https://github.com/kubernetes/minikube/releases/download/${MINIKUBE_VERSION}/${MINIKUBE_BIN}"
-    curl -fSL "${MINIKUBE_URL}" -o "${MINIKUBE_BIN}" 2>>"$LOG_FILE" || Stop-Script "Failed to download minikube."
-    curl -fSL "${MINIKUBE_URL}.sha256" -o "${MINIKUBE_BIN}.sha256" 2>>"$LOG_FILE" || Stop-Script "Failed to download minikube checksum."
-    echo "$(cat "${MINIKUBE_BIN}.sha256")  ${MINIKUBE_BIN}" | sha256sum -c - >>"$LOG_FILE" 2>&1 || Stop-Script "Minikube checksum verification failed."
-    install "${MINIKUBE_BIN}" /usr/local/bin/minikube
-    rm -f "${MINIKUBE_BIN}" "${MINIKUBE_BIN}.sha256"
-    Write-Log SUCCESS "minikube installed: $(minikube version --short 2>/dev/null)"
+case "$(Get-OsId)" in
+    ubuntu|debian) : ;;
+    *) Stop-Script "This script targets Ubuntu/Debian. Detected: $(Get-OsId). Use the K3s installer instead." ;;
+esac
+
+if [[ -f /etc/kubernetes/admin.conf || -f /etc/kubernetes/kubelet.conf ]]; then
+    Write-Log WARN "This node is already part of a Kubernetes cluster."
+    Write-Log INFO "Remove it first: sudo kubeadm reset -f && sudo rm -rf /etc/cni/net.d \$HOME/.kube/config"
+    exit 0
 fi
 
-# === Summary ===
-KUBECTL_VER=$(kubectl version --client --short 2>/dev/null || kubectl version --client)
-
-echo -e "\n${GREEN}==============================================================${NC}"
-Write-Log SUCCESS "Kubernetes installation complete!"
-echo -e "${GREEN}==============================================================${NC}\n"
-echo -e "${BLUE}kubectl:${NC}      ${GREEN}${KUBECTL_VER}${NC}"
-echo -e "${BLUE}Log:${NC}          ${GREEN}${LOG_FILE}${NC}"
-echo ""
-echo -e "${BLUE}Verify:${NC}       kubectl version --client"
-echo -e "${BLUE}Cluster:${NC}      kubectl cluster-info"
+case "$ROLE" in
+    control-plane) Install-ControlPlane ;;
+    worker)        Install-Worker "$SERVER_URL" "$JOIN_VALUE" "$CA_HASH" ;;
+    *)             Show-Usage; Stop-Script "Pass --control-plane or --worker." ;;
+esac
diff --git a/renovate.json b/renovate.json
index 47e5dc6..9d668ee 100644
--- a/renovate.json
+++ b/renovate.json
@@ -262,11 +262,11 @@
     {
       "datasourceTemplate": "github-releases",
       "matchStrings": [
-        "MINIKUBE_VERSION:-(?<currentValue>v[0-9.]+)"
+        "FLANNEL_VERSION:-(?<currentValue>v[0-9.]+)"
       ],
-      "description": "Minikube version in the bash installer",
+      "description": "Flannel CNI version in the bash installer",
       "customType": "regex",
-      "depNameTemplate": "kubernetes/minikube",
+      "depNameTemplate": "flannel-io/flannel",
       "managerFilePatterns": [
         "/^kubernetes/k8s_installer\\.sh$/"
       ]

From 9dcfbe32e497ec5c14c888dbecde2ea681da409b Mon Sep 17 00:00:00 2001
From: Stensel8 <102481635+Stensel8@users.noreply.github.com>
Date: Thu, 17 Sep 2026 09:15:49 +0200
Subject: [PATCH 2/2] fix: address review on K3s and kubeadm installers

- K3s: accept --url HOST:PORT without appending a second :6443
- both: stop when the node is not Ready after 120s instead of printing
  "ready" and join instructions
- K3s: add KUBECONFIG to the kubectl hint when kubectl is not the k3s link
- kubeadm: make node prep idempotent instead of skipping it when kubeadm
  exists (re-applies pinned packages, containerd cgroup driver, fstab)
- kubeadm: patch POD_CIDR into the Flannel manifest and validate it
---
 kubernetes/k3s_installer.sh | 39 +++++++++++++++++++++++++------------
 kubernetes/k8s_installer.sh | 37 ++++++++++++++++++++++-------------
 2 files changed, 51 insertions(+), 25 deletions(-)

diff --git a/kubernetes/k3s_installer.sh b/kubernetes/k3s_installer.sh
index 852459b..c47f7b0 100755
--- a/kubernetes/k3s_installer.sh
+++ b/kubernetes/k3s_installer.sh
@@ -118,7 +118,8 @@ Roles:
   --worker          Join this node to an existing cluster as a worker
 
 Options (worker):
-  --url URL         Control-plane API URL, or a bare IP/host (-> https://IP:6443)
+  --url HOST[:PORT] Control-plane API endpoint; port defaults to 6443
+                    (an https:// prefix is accepted)
   --token VALUE     Join value from the control plane
                     (/var/lib/rancher/k3s/server/node-token)
 
@@ -164,12 +165,15 @@ Install-ControlPlane() {
     Invoke-Cmd systemctl enable k3s
 
     Write-Log INFO "Waiting for the node to become Ready..."
-    local _
-    for _ in $(seq 1 45); do
-        k3s kubectl get node 2>/dev/null | grep -q ' Ready ' && break
+    local _ ready=false
+    for _ in $(seq 1 60); do
+        if k3s kubectl get node --no-headers 2>/dev/null | grep -q ' Ready '; then
+            ready=true; break
+        fi
         sleep 2
     done
-    k3s kubectl get node || Write-Log WARN "Node not Ready yet; re-check with 'sudo kubectl get node'."
+    k3s kubectl get node || true
+    $ready || Stop-Script "Node not Ready after 120s. Inspect: journalctl -u k3s -n 50. Join value, once fixed: /var/lib/rancher/k3s/server/node-token"
 
     local node_ip node_join k3s_ver
     node_ip=$(hostname -I | awk '{print $1}')
@@ -188,12 +192,19 @@ Install-ControlPlane() {
     echo -e "  sudo ./${SCRIPT_NAME} --worker \\"
     echo -e "      --url https://${node_ip}:6443 --token ${node_join:-(see /var/lib/rancher/k3s/server/node-token)}"
     echo ""
+    # The installer links kubectl to k3s, which reads /etc/rancher/k3s/k3s.yaml
+    # by default. It skips the link when another kubectl already exists; that
+    # one looks in ~/.kube/config, so it needs KUBECONFIG.
+    local kubectl_prefix=""
+    if [[ "$(readlink -f "$(command -v kubectl 2>/dev/null)" 2>/dev/null)" != "$(readlink -f "$(command -v k3s)")" ]]; then
+        kubectl_prefix="KUBECONFIG=/etc/rancher/k3s/k3s.yaml "
+    fi
     if [[ -n "$kube_group" ]]; then
         echo -e "${BOLD}Use kubectl (as ${kube_user}, no sudo needed)${NC}"
-        echo -e "  kubectl get nodes"
+        echo -e "  ${kubectl_prefix}kubectl get nodes"
     else
         echo -e "${BOLD}Use kubectl${NC}"
-        echo -e "  sudo kubectl get nodes"
+        echo -e "  sudo ${kubectl_prefix}kubectl get nodes"
     fi
     echo ""
     echo -e "${YELLOW}Cloud/firewall:${NC} nodes must reach each other on TCP 6443, TCP 10250 and"
@@ -203,12 +214,16 @@ Install-ControlPlane() {
 
 # Usage: Install-Worker <server-url-or-ip> <join-value>
 Install-Worker() {
-    local url=$1 join=$2
-
-    [[ -n "$url"  ]] || Stop-Script "Worker needs --url https://<control-plane-ip>:6443"
-    [[ -n "$join" ]] || Stop-Script "Worker needs --token <value from the control plane>"
-    [[ "$url" == https://* ]] || url="https://${url}:6443"
+    local endpoint=$1 join=$2 url
+
+    [[ -n "$endpoint" ]] || Stop-Script "Worker needs --url <control-plane-ip>:6443"
+    [[ -n "$join"     ]] || Stop-Script "Worker needs --token <value from the control plane>"
+    endpoint=${endpoint#https://}
+    endpoint=${endpoint%/}
+    [[ "$endpoint" == *:* ]] || endpoint="${endpoint}:6443"
+    [[ "$endpoint" =~ ^[A-Za-z0-9.-]+:[0-9]+$ ]] || Stop-Script "The --url value should look like 10.0.0.1:6443."
     [[ "$join" =~ ^[A-Za-z0-9:._-]+$ ]] || Stop-Script "The --token value has unexpected characters."
+    url="https://${endpoint}"
 
     # Fail fast when the API port is unreachable (on AWS: security group).
     # /ping is served unauthenticated by the K3s supervisor and returns "pong".
diff --git a/kubernetes/k8s_installer.sh b/kubernetes/k8s_installer.sh
index 795efec..6aad66c 100755
--- a/kubernetes/k8s_installer.sh
+++ b/kubernetes/k8s_installer.sh
@@ -159,13 +159,9 @@ export DEBIAN_FRONTEND=noninteractive
 # === Commands ===
 
 # Usage: Initialize-Node
-# Shared node prep for both roles. No-op if kubeadm is already installed.
+# Shared node prep for both roles. Safe to re-run: every step converges on the
+# pinned versions and settings, also when kubeadm or containerd already exist.
 Initialize-Node() {
-    if command -v kubeadm &>/dev/null; then
-        Write-Log WARN "kubeadm already installed ($(kubeadm version -o short 2>/dev/null)); skipping node prep."
-        return 0
-    fi
-
     local distro codename
     distro=$(Get-OsId)
     # shellcheck disable=SC1091
@@ -173,7 +169,7 @@ Initialize-Node() {
 
     Write-Log STEP "Disabling swap"
     swapoff -a
-    sed -i.bak '/\sswap\s/s/^\(.*\)$/#\1/' /etc/fstab
+    sed -i.bak '/^[^#].*\sswap\s/s/^/#/' /etc/fstab
 
     Write-Log STEP "Loading kernel modules (overlay, br_netfilter)"
     cat > /etc/modules-load.d/k8s.conf <<CONF
@@ -231,7 +227,7 @@ https://download.docker.com/linux/${distro} ${codename} stable" \
     chmod 644 /etc/apt/sources.list.d/kubernetes.list
 
     Invoke-Cmd apt-get update -y
-    Invoke-Cmd apt-get install -y "kubelet=${K8S_PKG_VERSION}" "kubeadm=${K8S_PKG_VERSION}" "kubectl=${K8S_PKG_VERSION}"
+    Invoke-Cmd apt-get install -y --allow-change-held-packages "kubelet=${K8S_PKG_VERSION}" "kubeadm=${K8S_PKG_VERSION}" "kubectl=${K8S_PKG_VERSION}"
     apt-mark hold kubelet kubeadm kubectl >> "$LOG_FILE" 2>&1
 
     Invoke-Cmd systemctl enable --now kubelet
@@ -239,6 +235,8 @@ https://download.docker.com/linux/${distro} ${codename} stable" \
 
 # Usage: Install-ControlPlane
 Install-ControlPlane() {
+    [[ "$POD_CIDR" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}/[0-9]{1,2}$ ]] || \
+        Stop-Script "POD_CIDR should look like 10.244.0.0/16."
     Initialize-Node
 
     Write-Log STEP "Running kubeadm init (${K8S_VERSION}, pod CIDR ${POD_CIDR})"
@@ -257,17 +255,30 @@ Install-ControlPlane() {
     fi
     export KUBECONFIG=/etc/kubernetes/admin.conf
 
-    Write-Log STEP "Installing the Flannel CNI ${FLANNEL_VERSION}"
-    Invoke-Cmd kubectl apply -f "${FLANNEL_MANIFEST}"
+    # Flannel's manifest hardcodes 10.244.0.0/16; patch in POD_CIDR so a custom
+    # range matches what kubeadm hands out.
+    Write-Log STEP "Installing the Flannel CNI ${FLANNEL_VERSION} (network ${POD_CIDR})"
+    local manifest
+    manifest=$(mktemp --suffix=.yml)
+    curl -fsSL "${FLANNEL_MANIFEST}" -o "$manifest" 2>>"$LOG_FILE" || \
+        Stop-Script "Failed to download the Flannel manifest."
+    grep -q '"Network": "10.244.0.0/16"' "$manifest" || \
+        Stop-Script "Flannel manifest layout changed; cannot set the pod network."
+    sed -i "s|\"Network\": \"10.244.0.0/16\"|\"Network\": \"${POD_CIDR}\"|" "$manifest"
+    Invoke-Cmd kubectl apply -f "$manifest"
+    rm -f "$manifest"
 
     # The node only turns Ready once the CNI is up.
     Write-Log INFO "Waiting for the node to become Ready..."
-    local _
+    local _ ready=false
     for _ in $(seq 1 60); do
-        kubectl get node 2>/dev/null | grep -q ' Ready ' && break
+        if kubectl get node --no-headers 2>/dev/null | grep -q ' Ready '; then
+            ready=true; break
+        fi
         sleep 2
     done
-    kubectl get node || Write-Log WARN "Node not Ready yet; re-check with 'kubectl get node'."
+    kubectl get node || true
+    $ready || Stop-Script "Node not Ready after 120s. Inspect: kubectl -n kube-flannel get pods; journalctl -u kubelet -n 50. Join command, once fixed: sudo kubeadm token create --print-join-command"
 
     # Split the join line into the worker flags this script takes.
     local join_line endpoint join_token ca_hash kubeadm_ver