Initial commit 🚀

2024-11-02 01:16:28 +00:00
1 parent e55ae1a1f5
commit 5a14609b2d
@@ -0,0 +1,15 @@
+# Talos Patching
+
+This directory contains Kustomization patches that are added to the talhelper configuration file.
+
+<https://www.talos.dev/v1.7/talos-guides/configuration/patching/>
+
+## Patch Directories
+
+Under this `patches` directory, there are several sub-directories that can contain patches that are added to the talhelper configuration file.
+Each directory is optional and therefore might not created by default.
+
+- `global/`: patches that are applied to both the controller and worker configurations
+- `controller/`: patches that are applied to the controller configurations
+- `worker/`: patches that are applied to the worker configurations
+- `${node-hostname}/`: patches that are applied to the node with the specified name
@@ -0,0 +1,8 @@
+machine:
+  features:
+    kubernetesTalosAPIAccess:
+      enabled: true
+      allowedRoles:
+        - os:admin
+      allowedKubernetesNamespaces:
+        - system-upgrade
@@ -0,0 +1,25 @@
+cluster:
+  allowSchedulingOnControlPlanes: true
+  controllerManager:
+    extraArgs:
+      bind-address: 0.0.0.0
+  coreDNS:
+    disabled: true
+  proxy:
+    disabled: true
+  scheduler:
+    extraArgs:
+      bind-address: 0.0.0.0
+    config:
+      apiVersion: kubescheduler.config.k8s.io/v1
+      kind: KubeSchedulerConfiguration
+      profiles:
+        - schedulerName: default-scheduler
+          pluginConfig:
+            - name: PodTopologySpread
+              args:
+                defaultingType: List
+                defaultConstraints:
+                  - maxSkew: 1
+                    topologyKey: kubernetes.io/hostname
+                    whenUnsatisfiable: ScheduleAnyway
@@ -0,0 +1,2 @@
+- op: remove
+  path: /cluster/apiServer/admissionControl
@@ -0,0 +1,6 @@
+cluster:
+  etcd:
+    extraArgs:
+      listen-metrics-urls: http://0.0.0.0:2381
+    advertisedSubnets:
+      - 10.0.10.0/24
@@ -0,0 +1,7 @@
+cluster:
+  discovery:
+    registries:
+      kubernetes:
+        disabled: false
+      service:
+        disabled: true
@@ -0,0 +1,12 @@
+machine:
+  files:
+    - op: create
+      path: /etc/cri/conf.d/20-customization.part
+      content: |-
+        [plugins."io.containerd.grpc.v1.cri"]
+          enable_unprivileged_ports = true
+          enable_unprivileged_icmp = true
+        [plugins."io.containerd.grpc.v1.cri".containerd]
+          discard_unpacked_layers = false
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+          discard_unpacked_layers = false
@@ -0,0 +1,3 @@
+machine:
+  network:
+    disableSearchDomain: true
@@ -0,0 +1,5 @@
+machine:
+  network:
+    nameservers:
+      - 1.1.1.1
+      - 1.0.0.1
@@ -0,0 +1,6 @@
+machine:
+  features:
+    hostDNS:
+      enabled: true
+      resolveMemberNames: true
+      forwardKubeDNSToHost: true # Requires Cilium `bpf.masquerade: false`
@@ -0,0 +1,7 @@
+machine:
+  kubelet:
+    extraArgs:
+      rotate-server-certificates: true
+    nodeIP:
+      validSubnets:
+        - 10.0.10.0/24
@@ -0,0 +1,5 @@
+machine:
+  time:
+    disabled: false
+    servers:
+      - time.cloudflare.com
@@ -0,0 +1,10 @@
+machine:
+  kubelet:
+    extraMounts:
+      - destination: /var/openebs/local
+        type: bind
+        source: /var/openebs/local
+        options:
+          - bind
+          - rshared
+          - rw
@@ -0,0 +1,6 @@
+machine:
+  sysctls:
+    fs.inotify.max_user_watches: "1048576"
+    fs.inotify.max_user_instances: "8192"
+    net.core.rmem_max: "7500000"
+    net.core.wmem_max: "7500000"
@@ -0,0 +1,110 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
+---
+# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
+talosVersion: v1.8.1
+# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+kubernetesVersion: v1.31.2
+
+clusterName: "home-cluster"
+endpoint: https://10.0.10.5:6443
+clusterPodNets:
+  - "10.69.0.0/16"
+clusterSvcNets:
+  - "10.96.0.0/16"
+additionalApiServerCertSans: &sans
+  - "10.0.10.5"
+  - 127.0.0.1 # KubePrism
+additionalMachineCertSans: *sans
+
+# Disable built-in Flannel to use Cilium
+cniConfig:
+  name: none
+
+nodes:
+  - hostname: "homecluster01"
+    ipAddress: "10.0.10.20"
+    installDisk: "/dev/vda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "52:54:00:23:9f:ea"
+        dhcp: false
+        addresses:
+          - "10.0.10.20/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+        vip:
+          ip: "10.0.10.5"
+  - hostname: "homecluster02"
+    ipAddress: "10.0.10.21"
+    installDisk: "/dev/sda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "ac:1f:6b:22:fa:4e"
+        dhcp: false
+        addresses:
+          - "10.0.10.21/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+        vip:
+          ip: "10.0.10.5"
+  - hostname: "homecluster03"
+    ipAddress: "10.0.10.22"
+    installDisk: "/dev/sda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: true
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "0c:c4:7a:e4:42:50"
+        dhcp: false
+        addresses:
+          - "10.0.10.22/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+        vip:
+          ip: "10.0.10.5"
+  - hostname: "homecluster04"
+    ipAddress: "10.0.10.23"
+    installDisk: "/dev/vda"
+    talosImageURL: factory.talos.dev/installer/b3ecfdd3351d94b41e93752fd6088fa3976f2caf86c0c4266404f9872d04516a
+    controlPlane: false
+    networkInterfaces:
+      - deviceSelector:
+          hardwareAddr: "52:54:00:23:ab:c4"
+        dhcp: false
+        addresses:
+          - "10.0.10.23/24"
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "10.0.10.1"
+        mtu: 1500
+
+# Global patches
+patches:
+  - "@./patches/global/cluster-discovery.yaml"
+  - "@./patches/global/containerd.yaml"
+  - "@./patches/global/disable-search-domain.yaml"
+  - "@./patches/global/dns.yaml"
+  - "@./patches/global/hostdns.yaml"
+  - "@./patches/global/kubelet.yaml"
+  - "@./patches/global/ntp.yaml"
+  - "@./patches/global/openebs-local.yaml"
+  - "@./patches/global/sysctl.yaml"
+
+# Controller patches
+controlPlane:
+  patches:
+    - "@./patches/controller/api-access.yaml"
+    - "@./patches/controller/cluster.yaml"
+    - "@./patches/controller/disable-admission-controller.yaml"
+    - "@./patches/controller/etcd.yaml"
+