feat(talos): Add secureboot & tpm-based disk encryption support (#1315)

* feat(talos): Add secureboot & tpm-based disk encryption support

* feat(talos): Add secureboot & tpm-based disk encryption example config

bootstrap/templates/kubernetes/talos/talconfig.yaml.j2

@@ -31,7 +31,13 @@ nodes:
     installDiskSelector:
       serial: "{{ item.talos_disk_device }}"
     {% endif %}
+    {% if distribution.talos.secureboot.enabled %}
+    machineSpec:
+      secureboot: true
+    talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }}
+    {% else %}
     talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }}
+    {% endif %}
     controlPlane: {{ (item.controller) | string | lower }}
     networkInterfaces:
       - interface: eth0
@@ -152,6 +158,24 @@ patches:
         extraKernelArgs:
           - net.ifnames=0
 
+  {% if distribution.talos.secureboot.enabled and
+        distribution.talos.secureboot.encrypt_disk_with_tpm %}
+  # Encrypt system disk with TPM
+  - |-
+    machine:
+      systemDiskEncryption:
+        ephemeral:
+          provider: luks2
+          keys:
+            - slot: 0
+              tpm: {}
+        state:
+          provider: luks2
+          keys:
+            - slot: 0
+              tpm: {}
+  {% endif %}
+
 controlPlane:
   patches:
     # Cluster configuration

config.sample.yaml

@@ -32,6 +32,13 @@ distribution:
     #   #   existing networks and is usually a /16 (64K IPs).
     #   # If you want to use IPv6 check the advanced flags below
     #   loadbalancer_network: 10.123.0.0/16
+    # secureboot:
+    #   # (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
+    #   #   See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot
+    #   enabled: true
+    #   # (Optional) Enable TPM-based disk encryption. Requires TPM 2.0
+    #   #   See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm
+    #   encrypt_disk_with_tpm: true
 
 #
 # (Required) Timezone is your IANA formatted timezone (e.g. America/New_York)