Tailscale + k3s on RaspberryPi 4 (1 master node and 3 agent nodes)

setup_tailscale_k3s_raspi4.sh

#!/usr/bin/env bash

# ===
# > master node & agent node(s)
# ===
sudo apt update -y && sudo apt upgrade -y

sudo systemctl stop dphys-swapfile
sudo systemctl disable dphys-swapfile
sudo rm -f /var/swap

echo 'NTP=ntp.nict.jp' | sudo tee -a /etc/systemd/timesyncd.conf
sudo systemctl restart systemd-timesyncd

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

curl https://mise.run | sh
echo 'eval "$($HOME/.local/bin/mise activate bash)"' >>~/.bashrc
eval "$($HOME/.local/bin/mise activate bash)"
mise use --global python@latest
mise use --global go@latest

echo "$(</boot/firmware/cmdline.txt) cgroup_memory=1 cgroup_enable=memory" > cmdline.txt
cat cmdline.txt | sudo tee /boot/firmware/cmdline.txt
rm cmdline.txt

sudo reboot

# ===
# > master node
# ===
MASTER_NODE_IP="$(tailscale status | awk 'NR==1{print$1}')"
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --flannel-iface tailscale0 --advertise-address $MASTER_NODE_IP --node-ip $MASTER_NODE_IP --node-external-ip $MASTER_NODE_IP" sh -s
sudo k3s token create # get token
echo 'alias kubectl="sudo k3s kubectl"' >> ~/.bash_aliases

# ===
# > agent node(s)
# ===
K3S_MASTER_TOKEN="..."
MASTER_NODE_HOSTNAME="pi01"
MASTER_NODE_IP="$(tailscale status | awk -v m="$MASTER_NODE_HOSTNAME" '$2==m{print$1}')"
AGENT_NODE_IP="$(tailscale status | awk 'NR==1{print$1}')"
curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent --server https://${MASTER_NODE_IP}:6443 --token $K3S_MASTER_TOKEN --flannel-iface tailscale0 --node-ip $AGENT_NODE_IP --node-external-ip $AGENT_NODE_IP" sh -s

# check service status is up
systemctl status k3s-agent.service

# ===
# > master node
# ===
# check nodes

kubectl get nodes
# NAME   STATUS   ROLES                  AGE     VERSION
# pi01   Ready    control-plane,master   2m37s   v1.31.4+k3s1
# pi02   Ready    <none>                 105s    v1.31.4+k3s1
# pi03   Ready    <none>                 79s     v1.31.4+k3s1
# pi04   Ready    <none>                 54s     v1.31.4+k3s1

kubectl get -A pods
# NAMESPACE     NAME                                      READY   STATUS      RESTARTS   AGE
# kube-system   coredns-ccb96694c-fxgx2                   1/1     Running     0          2m57s
# kube-system   helm-install-traefik-crd-577wr            0/1     Completed   0          2m57s
# kube-system   helm-install-traefik-n2lpr                0/1     Completed   1          2m57s
# kube-system   local-path-provisioner-5cf85fd84d-8crww   1/1     Running     0          2m57s
# kube-system   metrics-server-5985cbc9d7-hk6hv           1/1     Running     0          2m57s
# kube-system   svclb-traefik-b7bd8ff4-2m8m9              2/2     Running     0          107s
# kube-system   svclb-traefik-b7bd8ff4-6khf2              2/2     Running     0          82s
# kube-system   svclb-traefik-b7bd8ff4-bmfln              2/2     Running     0          2m14s
# kube-system   svclb-traefik-b7bd8ff4-pnngz              2/2     Running     0          2m12s
# kube-system   traefik-57b79cf995-bhrfw                  1/1     Running     0          2m15s

How to change master node machine into new one:
https://wirywolf.com/2022/11/change-master-node-on-k3s

Argo CD

# install without TLS
kubectl create namespace argocd
curl -sL https://raw.githubusercontent.com/argoproj/argo-cd/v2.13.2/manifests/install.yaml | sed '/^  name: argocd-cmd-params-cm/adata:\n  server.insecure: "true"' > install.yaml
kubectl apply -n argocd -f ./install.yaml

# get default password (default username is `admin`)
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# expose 443 as 8080
nohup sudo k3s kubectl port-forward svc/argocd-server -n argocd --address 0.0.0.0 8080:443 &

# stop
jobs  # check job id
kill %1

http://pi01.local:8080 / http://pi01.hogehogehoge.ts.net:8000/