sudo apt update && sudo apt upgrade -y

sudo swapoff -a

sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

sudo tee /etc/modules-load.d/containerd.conf <<EOF
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

sudo tee /etc/sysctl.d/kubernetes.conf <<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
net.ipv4.ip_unprivileged_port_start=0
EOF

sudo sysctl --system

sudo apt update -y

sudo apt install -y curl software-properties-common apt-transport-https ca-certificates

curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.29/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.29/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmour -o /etc/apt/trusted.gpg.d/docker.gpg
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

sudo apt update -y

sudo apt install -y containerd.io

containerd config default | sudo tee /etc/containerd/config.toml >/dev/null 2>&1
sudo sed -i 's/SystemdCgroup \= false/SystemdCgroup \= true/g' /etc/containerd/config.toml

sudo systemctl restart containerd
sudo systemctl enable containerd

sudo apt install -y kubelet kubeadm kubectl

sudo apt-mark hold kubelet kubeadm kubectl

sudo reboot

export MACHINE_IP=$(hostname -I | awk '{print $1}')

sudo kubeadm init --pod-network-cidr=10.96.0.0/12 --control-plane-endpoint=${MACHINE_IP} --v=5

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/calico.yaml

watch kubectl get nodes -A

curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list

sudo apt update

sudo apt install helm

helm install traefik traefik/traefik --namespace traefik --create-namespace -f traefik-values.yaml

ports:
  web:
    port: 80
  websecure:
    port: 443
service:
  type: LoadBalancer

additionalArguments:
  - "--api.dashboard=true"

helm install longhorn longhorn-system/longhorn-manager --namespace longhorn-system --create-namespace

helm repo add rancher-stable https://releases.rancher.com/server-charts/stable

kubectl create namespace cattle-system

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.3/cert-manager.yaml

helm repo add jetstack https://charts.jetstack.io

helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace

helm install rancher rancher-stable/rancher \
--namespace cattle-system --create-namespace \
--set hostname=${RANCHER_DOMAIN} \
--set ingress.tls.source=secret \
--set ingress.tls.secretName=rancher-cert-tls \
--set bootstrapPassword=admin

kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: rancher-cert
 namespace: cattle-system
spec:
 secretName: rancher-cert-tls
 issuerRef:
   name: letsencrypt-prod
   kind: ClusterIssuer
 dnsNames:
 - ${RANCHER_DOMAIN}
EOF

export NODE_NAME=$(hostname)

kubectl taint nodes ${NODE_NAME} node-role.kubernetes.io/control-plane-

kubectl taint nodes ${NODE_NAME} node-role.kubernetes.io/control-plane:NoSchedule