feat(talos): Add secureboot & tpm-based disk encryption support (#1315)

* feat(talos): Add secureboot & tpm-based disk encryption support

* feat(talos): Add secureboot & tpm-based disk encryption example config

bootstrap/templates/kubernetes/talos/talconfig.yaml.j2

@@ -31,7 +31,13 @@ nodes:
     installDiskSelector:
       serial: "{{ item.talos_disk_device }}"
     {% endif %}
+    {% if distribution.talos.secureboot.enabled %}
+    machineSpec:
+      secureboot: true
+    talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }}
+    {% else %}
     talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }}
+    {% endif %}
     controlPlane: {{ (item.controller) | string | lower }}
     networkInterfaces:
       - interface: eth0
@@ -152,6 +158,24 @@ patches:
         extraKernelArgs:
           - net.ifnames=0
 
+  {% if distribution.talos.secureboot.enabled and
+        distribution.talos.secureboot.encrypt_disk_with_tpm %}
+  # Encrypt system disk with TPM
+  - |-
+    machine:
+      systemDiskEncryption:
+        ephemeral:
+          provider: luks2
+          keys:
+            - slot: 0
+              tpm: {}
+        state:
+          provider: luks2
+          keys:
+            - slot: 0
+              tpm: {}
+  {% endif %}
+
 controlPlane:
   patches:
     # Cluster configuration