u7s.yaml

# Deploy kubernetes via usernetes.
# $ limactl start ./u7s.yaml
# $ limactl shell u7s kubectl

# It can be accessed from the host by exporting the kubeconfig file;
# the ports are already forwarded automatically by lima:
#
# $ export KUBECONFIG=$(limactl list u7s --format 'unix://{{.Dir}}/copied-from-guest/kubeconfig.yaml')
# $ kubectl get no
# NAME           STATUS   ROLES           AGE   VERSION
# u7s-lima-u7s   Ready    control-plane   33s   v1.28.0

minimumLimaVersion: 2.0.0

base: template:_images/ubuntu-lts

# Mounts are disabled in this template, but can be enabled optionally.
mounts: []
# containerd is managed by Docker, not by Lima, so the values are set to false here.
containerd:
  system: false
  user: false
provision:
- mode: system
  script: |
    #!/bin/bash
    set -eux -o pipefail
    command -v kubectl >/dev/null 2>&1 && exit 0
    version=$(curl -L -s https://dl.k8s.io/release/stable.txt)
    case $(uname -m) in
      x86_64)   arch=amd64;;
      aarch64)  arch=arm64;;
    esac
    curl -L "https://dl.k8s.io/release/$version/bin/linux/$arch/kubectl" -o /usr/local/bin/kubectl
    chmod 755 /usr/local/bin/kubectl
    kubectl version --client
- mode: user
  script: |
    #!/bin/bash
    set -eux -o pipefail
    test -d ~/usernetes && exit 0
    cd ~
    git clone --branch=gen2-v20251218.0 https://github.com/rootless-containers/usernetes
- mode: user
  script: |
    #!/bin/bash
    set -eux -o pipefail
    cd ~/usernetes/init-host
    sudo ./init-host.root.sh
    ./init-host.rootless.sh
- mode: user
  script: |
    #!/bin/bash
    set -eux -o pipefail
    test -e ~/usernetes/kubeconfig && exit 0
    cd ~/usernetes
    export KUBECONFIG="$(pwd)/kubeconfig"
    make up
    sleep 5
    make kubeadm-init
    # Installing a Pod network add-on
    make install-flannel
    # Control plane node isolation
    make kubeconfig
    kubectl taint nodes --all node-role.kubernetes.io/control-plane-
    # Symlink the kubeconfig file to the default location for kubectl
    mkdir -p ~/.kube && ln -sf $KUBECONFIG ~/.kube/config
    # Replace the server address with localhost, so that it works from the host.
    # The original kubeconfig is kept unmodified, so that `kubeadm token create --print-join-command`
    # can still print the reachable address.
    sed -e "/server:/ s|https://.*:\([0-9]*\)$|https://127.0.0.1:\1|" $KUBECONFIG >kubeconfig.localhost
probes:
- description: "kubectl to be installed"
  script: |
    #!/bin/bash
    set -eux -o pipefail
    if ! timeout 30s bash -c "until command -v kubectl >/dev/null 2>&1; do sleep 3; done"; then
      echo >&2 "kubectl is not installed yet"
      exit 1
    fi
  hint: |
    See "/var/log/cloud-init-output.log" in the guest
- description: "kubeadm to be completed"
  script: |
    #!/bin/bash
    set -eux -o pipefail
    if ! timeout 300s bash -c "until test -f ~/usernetes/kubeconfig; do sleep 3; done"; then
      echo >&2 "k8s is not running yet"
      exit 1
    fi
  hint: |
    The k8s kubeconfig file has not yet been created.
- description: "kubernetes cluster to be running"
  script: |
    #!/bin/bash
    set -eux -o pipefail
    if ! timeout 300s bash -c "until kubectl version >/dev/null 2>&1; do sleep 3; done"; then
      echo >&2 "kubernetes cluster is not up and running yet"
      exit 1
    fi
- description: "coredns deployment to be running"
  script: |
    #!/bin/bash
    set -eux -o pipefail
    kubectl wait -n kube-system --timeout=180s --for=condition=available deploy coredns
copyToHost:
- guest: "{{.Home}}/usernetes/kubeconfig.localhost"
  host: "{{.Dir}}/copied-from-guest/kubeconfig.yaml"
  deleteOnStop: true
message: |
  To run `kubectl` on the host (assumes kubectl is installed), run the following commands:
  ------
  export KUBECONFIG="{{.Dir}}/copied-from-guest/kubeconfig.yaml"
  kubectl ...
  ------