Initial commit 🚀

2024-11-02 01:16:28 +00:00
1 parent e55ae1a1f5
commit 5a14609b2d
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: github-deploy-key
+    namespace: flux-system
+stringData:
+    identity: ENC[AES256_GCM,data:LoT8L1tlhfA+L/n4JsNJE+MwlA7lS9ZXbE++ZyCKDFvy1ThW8Uki6oerYUJstuPsoCizjydUU/riBTTuOHvJQGqmOIAz1KiLKdNOSWWDb0r5ULR016PLsIOEB3jgoKP9OJZYuJEDSliz6Yo5Qibj4Uqd6PmgPZ4aSZnGAZqYbMTiwZ4SU/xNFBNawDoX6uOPoA+Xmhze7UDIKf4GgAhq2i63b7K7H6meR+BcyF36qSH0YA0iqMOa+MXmxs+T6vQIR302AUu1Sf0ajf0FgD14QfgEhep7JJf7MeOjPTmqvFDQPWEut7jar/SCT1z+NGjNt/gZnGBg7/x4VhRsg4v2PwXpQOpcH0kH8TUgVanV7bzPPtTSSsbD1I4XoxS2kuHwV9Goued4NL95fmtGnP5EuuRrd52lXTS5At4PeaLaZ5Rb4FS77c+nq26JC6yBX1SD5UT5by94VWa8qiXVv4rbEkghK0tcerE50+MPMBPeGaWUgbwlR3BGX7I04a+eZsNoypYR1nDAw+Gt/z7LDfDruYfjh8niFsFeVLb88COk6pq5/vBH+y2eXY7k3EnlUaDWhCqo6/GeEyji1b+7rGJ+Clljyz7SnMvz3+vbCM+jVZLA3/XX2SiQXpPHQ/YHIBbbIUYw+h2p/8rRSNawj4mC+b78PQe8sNngne1OJC/uSoUriTWUUSZgFwGPyfG3rFVZ3Ef/yGwWa6xokZSkYj4PTifIEQpf/EExYsBwCdT/CYfpWOBZ/dDG74Q65MnCgkyWe5/C44x7O/0acNdPKHAjsycwk1ZWuPfjwDkluQeC6eekC3rkBVK1/dnaY5et2z3IDpSdU+2+PTYOzgVQHfuSF4vuhGJAW5QtN4fNuPABbungdVyDbeuA2zUAWNNNdSmPoYvj9P7DJfRkiVyyrRpoqg+N8Uk80BNGK80t6XsnHLnNXPuTtrNsYqz2flooA9y8clhNkn8xrOqbt3hbVNy0Ig==,iv:/9EHvyqdzBark6t1+K2aK3JOA79y9vCvyKfUY2p7g/s=,tag:6c7gKFUjuzNZQpv2BlFEFg==,type:str]
+    known_hosts: ENC[AES256_GCM,data:1ijqT9gM1m7xAwxeIfe2hyeotBsWoZnt2/sBGleYrZwM9iRs3FjdVJ23Qqjk6ZPPkeBkaDdJt4oayrr/YQDj/gJ8Vc+Utnw4zpjWedFGokvBs2puo8MgU88JHdR5BUq6d9mir2b1v27gdph6beF3hqNLC1XBFzOgRYPLHSKqoxKbaD8uIclbtQigFWsT2TAqdO1V7W2yNlAx1Sn5SQ8KCsORJN0QPgkDgjUDOCz/vC/igjiu2hkqngNKFkpQCOR3mAhZ6xs/cQuenm5So2VgbepW789yRHM2J+SvL8Fsmyac7VJV7eNE0eGyxSBW6Ia2p10xbyt/U+JscnMZicwqoKNcKxqDzzhTTDis8XS8liCxH1xnldxjl4YOt0baVHRgDBRlZRvz/nTlbEwVqgp6XpySWpIvQPdHM68MK3ElTYCjihvi0roKHRGLIcXhoHt87ohldjQoyGlXVMgA+CbrtKDc0OOoMm63uQoxIEgaR6lZ7igLknzqwRFqfKeqC9/CmjwPB0o1eqL7fJp0N03qeF2KjHZxVPuOF54QMDCv0R0m01/ca/8CWFlw1NjkBx4XcpY++7U44T594EMTY4K4mmNfyyhTAyspv5CeHJJ/BrpiS3WHaBh8cLJYnNGgu5fP6+dpnhLJ8WB205xx0DL9ghGYEZikKU3i2GTNwSh8cU9hQU00hcDU8W4GgfsYozh4fvM2SiYh7WccNkHuAopO9JEq0Vo7iGxQlhQzHP1aLRs7Wf7Rx+yJrXn3R5Rq8nAZov6B7s6N+xZuJHELRPQNCLPHfQG5oMcOOLleEKYlCK7K1cC1T2ayTMKDdfrHjI8KE4zWhbdwYT4Nqu7DKwYcJZmA/25d6ZH2AOTYT2wfSf+HGKCCRts4TnBy2AyUuY/BWCrT0OJAfxro6lBwKqY9ITwjjA5qZyD3+qF1RVwQ7I66qQ1Xi9pl+K53oSqsJAh9sSGYy/YAXwU+qxbTuFWgUR4wgKTx0BTV1bNSM+N5aADFvBxElkh/VXhiHiPznj9FlXwhJLDTtwWvK2AUU8CcrENTf4AvpkKOqY6QU7NzcemKcyqkRltQec8lvV7F2uxKLLUPHVzwMx9ZqHGa4SkSLhJD4W2ZA8a6j52NXNnyh2qwVPQt4TZVkwJRIGNi5eMTb8hFSs/tW0WEFBy9qOiYrNnP5xSAaq9MNwi9XaZw7vas8/IeGw1Al5SDb2iQhX6zQtdlcBugb72PIKZZoxGRzBaj,iv:PDclfW9ICUWKf0seZHAuvd4nzVLr4rWfiS3yWNGV81s=,tag:U1XQkLTJrTdcBItmMMM6zA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMM3FMblA5bVowZUVhWnJl
+            cEYvOVBYY1F1VjJXaXJWR0NnSnFrWVNxQUg0Ckcrd1RqbkkwVGFHUWZmS2VXTWli
+            YjF3Y1gyOXhRSk1nWUVwaUQyQWNaa1kKLS0tIHB2QW1kRUJwTUVTL3dYWEwzbGNt
+            S3A5UjdvQklFZGxjNEcvUmV0SmxjdUUKqwQlo246HlO4bu/A5GCcZUwvpAfVMa2p
+            FvzAm+ybR9w0Vwa5E2u9e80mYYEqJxFivNs0/64F1KcBBREC49FJcA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-02T01:13:55Z"
+    mac: ENC[AES256_GCM,data:Pe/Rt02X2XP8M8nOx9DpVzJPgwDUd8+oyPlgQGVq1tN+QM/3vPed/MsYY5AVmI8hUK1jI/J9oG5DaqoAKXoeIQsiwkPv/gDh9knU8R44K1W8ahv2p7JktT0KwkDyD3pp5gcj1Fobcg8da5CLb7wFfwKpeUvSQ2CtN3a7V6Bfp8E=,iv:CLqqDKrOgMLUXGzBmL9jpQyQEfgNMHXYXfyNGvYH9Rc=,tag:LL2Ph3hIFIdFNmvT+5OAag==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
@@ -0,0 +1,61 @@
+# IMPORTANT: This file is not tracked by flux and should never be. Its
+# purpose is to only install the Flux components and CRDs into your cluster.
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - github.com/fluxcd/flux2/manifests/install?ref=v2.4.0
+patches:
+  # Remove the default network policies
+  - patch: |-
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: NetworkPolicy
+      metadata:
+        name: not-used
+    target:
+      group: networking.k8s.io
+      kind: NetworkPolicy
+  # Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
+  - target:
+      kind: ResourceQuota
+      name: critical-pods
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: critical-pods-flux-system
+  - target:
+      kind: ClusterRoleBinding
+      name: cluster-reconciler
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: cluster-reconciler-flux-system
+  - target:
+      kind: ClusterRoleBinding
+      name: crd-controller
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: crd-controller-flux-system
+  - target:
+      kind: ClusterRole
+      name: crd-controller
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: crd-controller-flux-system
+  - target:
+      kind: ClusterRole
+      name: flux-edit
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: flux-edit-flux-system
+  - target:
+      kind: ClusterRole
+      name: flux-view
+    patch: |
+      - op: replace
+        path: /metadata/name
+        value: flux-view-flux-system
@@ -0,0 +1,59 @@
+---
+helmDefaults:
+  wait: true
+  waitForJobs: true
+  timeout: 600
+  recreatePods: true
+  force: true
+
+repositories:
+  - name: cilium
+    url: https://helm.cilium.io
+  - name: coredns
+    url: https://coredns.github.io/helm
+  - name: postfinance
+    url: https://postfinance.github.io/kubelet-csr-approver
+
+releases:
+  - name: prometheus-operator-crds
+    namespace: observability
+    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
+    version: 15.0.0
+  - name: cilium
+    namespace: kube-system
+    chart: cilium/cilium
+    version: 1.16.3
+    values:
+      - ../apps/kube-system/cilium/app/helm-values.yaml
+    needs:
+      - observability/prometheus-operator-crds
+  - name: coredns
+    namespace: kube-system
+    chart: coredns/coredns
+    version: 1.36.0
+    values:
+      - ../apps/kube-system/coredns/app/helm-values.yaml
+    needs:
+      - observability/prometheus-operator-crds
+      - kube-system/cilium
+  - name: kubelet-csr-approver
+    namespace: kube-system
+    chart: postfinance/kubelet-csr-approver
+    version: 1.2.3
+    values:
+      - ../apps/kube-system/kubelet-csr-approver/app/helm-values.yaml
+    needs:
+      - observability/prometheus-operator-crds
+      - kube-system/cilium
+      - kube-system/coredns
+  - name: spegel
+    namespace: kube-system
+    chart: oci://ghcr.io/spegel-org/helm-charts/spegel
+    version: v0.0.27
+    values:
+      - ../apps/kube-system/spegel/app/helm-values.yaml
+    needs:
+      - observability/prometheus-operator-crds
+      - kube-system/cilium
+      - kube-system/coredns
+      - kube-system/kubelet-csr-approver
@@ -0,0 +1,15 @@
+# Talos Patching
+
+This directory contains Kustomization patches that are added to the talhelper configuration file.
+
+<https://www.talos.dev/v1.7/talos-guides/configuration/patching/>
+
+## Patch Directories
+
+Under this `patches` directory, there are several sub-directories that can contain patches that are added to the talhelper configuration file.
+Each directory is optional and therefore might not created by default.
+
+- `global/`: patches that are applied to both the controller and worker configurations
+- `controller/`: patches that are applied to the controller configurations
+- `worker/`: patches that are applied to the worker configurations
+- `${node-hostname}/`: patches that are applied to the node with the specified name
@@ -0,0 +1,8 @@
+machine:
+  features:
+    kubernetesTalosAPIAccess:
+      enabled: true
+      allowedRoles:
+        - os:admin
+      allowedKubernetesNamespaces:
+        - system-upgrade
@@ -0,0 +1,25 @@
+cluster:
+  allowSchedulingOnControlPlanes: true
+  controllerManager:
+    extraArgs:
+      bind-address: 0.0.0.0
+  coreDNS:
+    disabled: true
+  proxy:
+    disabled: true
+  scheduler:
+    extraArgs:
+      bind-address: 0.0.0.0
+    config:
+      apiVersion: kubescheduler.config.k8s.io/v1
+      kind: KubeSchedulerConfiguration
+      profiles:
+        - schedulerName: default-scheduler
+          pluginConfig:
+            - name: PodTopologySpread
+              args:
+                defaultingType: List
+                defaultConstraints:
+                  - maxSkew: 1
+                    topologyKey: kubernetes.io/hostname
+                    whenUnsatisfiable: ScheduleAnyway
@@ -0,0 +1,2 @@
+- op: remove
+  path: /cluster/apiServer/admissionControl
@@ -0,0 +1,6 @@
+cluster:
+  etcd:
+    extraArgs:
+      listen-metrics-urls: http://0.0.0.0:2381
+    advertisedSubnets:
+      - 10.0.10.0/24
@@ -0,0 +1,7 @@
+cluster:
+  discovery:
+    registries:
+      kubernetes:
+        disabled: false
+      service:
+        disabled: true
@@ -0,0 +1,12 @@
+machine:
+  files:
+    - op: create
+      path: /etc/cri/conf.d/20-customization.part
+      content: |-
+        [plugins."io.containerd.grpc.v1.cri"]
+          enable_unprivileged_ports = true
+          enable_unprivileged_icmp = true
+        [plugins."io.containerd.grpc.v1.cri".containerd]
+          discard_unpacked_layers = false
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+          discard_unpacked_layers = false
@@ -0,0 +1,3 @@
+machine:
+  network:
+    disableSearchDomain: true
@@ -0,0 +1,5 @@
+machine:
+  network:
+    nameservers:
+      - 1.1.1.1
+      - 1.0.0.1
@@ -0,0 +1,6 @@
+machine:
+  features:
+    hostDNS:
+      enabled: true
+      resolveMemberNames: true
+      forwardKubeDNSToHost: true # Requires Cilium `bpf.masquerade: false`
@@ -0,0 +1,7 @@
+machine:
+  kubelet:
+    extraArgs:
+      rotate-server-certificates: true
+    nodeIP:
+      validSubnets:
+        - 10.0.10.0/24
@@ -0,0 +1,5 @@
+machine:
+  time:
+    disabled: false
+    servers:
+      - time.cloudflare.com
@@ -0,0 +1,10 @@
+machine:
+  kubelet:
+    extraMounts:
+      - destination: /var/openebs/local
+        type: bind
+        source: /var/openebs/local
+        options:
+          - bind
+          - rshared
+          - rw
@@ -0,0 +1,6 @@
+machine:
+  sysctls:
+    fs.inotify.max_user_watches: "1048576"
+    fs.inotify.max_user_instances: "8192"
+    net.core.rmem_max: "7500000"
+    net.core.wmem_max: "7500000"
@@ -0,0 +1,110 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
+---
+# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
+talosVersion: v1.8.1
+# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+kubernetesVersion: v1.31.2
+
+clusterName: "home-cluster"
+endpoint: https://10.0.10.5:6443
+clusterPodNets:
+  - "10.69.0.0/16"
+clusterSvcNets:
+  - "10.96.0.0/16"
+additionalApiServerCertSans: &sans
+  - "10.0.10.5"
+  - 127.0.0.1 # KubePrism
+additionalMachineCertSans: *sans
+
+# Disable built-in Flannel to use Cilium
+cniConfig:
+  name: none
+
+nodes:
+  - hostname: "homecluster01"
+    ipAddress: "10.0.10.20"
+    installDisk: "/dev/vda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "52:54:00:23:9f:ea"
+        dhcp: false
+        addresses:
+          - "10.0.10.20/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+        vip:
+          ip: "10.0.10.5"
+  - hostname: "homecluster02"
+    ipAddress: "10.0.10.21"
+    installDisk: "/dev/sda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "ac:1f:6b:22:fa:4e"
+        dhcp: false
+        addresses:
+          - "10.0.10.21/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+        vip:
+          ip: "10.0.10.5"
+  - hostname: "homecluster03"
+    ipAddress: "10.0.10.22"
+    installDisk: "/dev/sda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "0c:c4:7a:e4:42:50"
+        dhcp: false
+        addresses:
+          - "10.0.10.22/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+        vip:
+          ip: "10.0.10.5"
+  - hostname: "homecluster04"
+    ipAddress: "10.0.10.23"
+    installDisk: "/dev/vda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: false
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "52:54:00:23:ab:c4"
+        dhcp: false
+        addresses:
+          - "10.0.10.23/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+
+# Global patches
+patches:
+  - "@./patches/global/cluster-discovery.yaml"
+  - "@./patches/global/containerd.yaml"
+  - "@./patches/global/disable-search-domain.yaml"
+  - "@./patches/global/dns.yaml"
+  - "@./patches/global/hostdns.yaml"
+  - "@./patches/global/kubelet.yaml"
+  - "@./patches/global/ntp.yaml"
+  - "@./patches/global/openebs-local.yaml"
+  - "@./patches/global/sysctl.yaml"
+
+# Controller patches
+controlPlane:
+  patches:
+    - "@./patches/controller/api-access.yaml"
+    - "@./patches/controller/cluster.yaml"
+    - "@./patches/controller/disable-admission-controller.yaml"
+    - "@./patches/controller/etcd.yaml"
+