fix: address talos comments (#1253)

* fix: update cni to cilium in taskfile

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: more updates

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: more cleanup

Signed-off-by: Devin Buhl <devin@buhl.casa>

* chore: housekeeping

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -1,14 +1,12 @@
 ---
-# https://github.com/PyratLabs/ansible-role-k3s
-# renovate: datasource=github-releases depName=k3s-io/k3s
-k3s_release_version: v1.29.0+k3s1
-k3s_install_hard_links: true
 k3s_become: true
 k3s_etcd_datastore: true
-k3s_use_unsupported_config: true
+k3s_install_hard_links: true
 k3s_registration_address: "#{ bootstrap_kube_api_addr }#"
-# /var/lib/rancher/k3s/server/manifests
+# renovate: datasource=github-releases depName=k3s-io/k3s
+k3s_release_version: v1.29.0+k3s1
 k3s_server_manifests_templates:
   - custom-cilium-helmchart.yaml
   - kube-vip-ds.yaml
   - kube-vip-rbac.yaml
+k3s_use_unsupported_config: true

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -1,27 +1,6 @@
 ---
-# https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
-# https://github.com/PyratLabs/ansible-role-k3s
 k3s_control_node: true
 k3s_server:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
-  #% else %#
-  node-ip: "{{ ansible_host }}"
-  #% endif %#
-  tls-san:
-    - "#{ bootstrap_kube_api_addr }#"
-    #% for item in bootstrap_kube_additional_tls_sans %#
-    - "{{ item }}"
-    #% endfor %#
-  docker: false
-  flannel-backend: "none" # quote
-  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
-  disable-network-policy: true
-  disable-cloud-controller: true
-  disable-kube-proxy: true
-  write-kubeconfig-mode: "644"
-  pause-image: registry.k8s.io/pause:3.9
-  secrets-encryption: true
   #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
   cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#"
   service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#"
@@ -29,13 +8,32 @@ k3s_server:
   cluster-cidr: "#{ bootstrap_cluster_cidr }#"
   service-cidr: "#{ bootstrap_service_cidr }#"
   #% endif %#
-  etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack
-  kube-controller-manager-arg:
-    - "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack
-  kube-scheduler-arg:
-    - "bind-address=0.0.0.0" # Required to monitor kube-scheduler with kube-prometheus-stack
+  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
+  disable-cloud-controller: true
+  disable-kube-proxy: true
+  disable-network-policy: true
+  docker: false
+  etcd-expose-metrics: true
+  flannel-backend: "none"
   kube-apiserver-arg:
-    - "anonymous-auth=true" # Required for external LB health-checks
+    - "anonymous-auth=true"
+  kube-controller-manager-arg:
+    - "bind-address=0.0.0.0"
+  kube-scheduler-arg:
+    - "bind-address=0.0.0.0"
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
+  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
+  #% else %#
+  node-ip: "{{ ansible_host }}"
+  #% endif %#
+  pause-image: registry.k8s.io/pause:3.9
+  secrets-encryption: true
+  tls-san:
+    - "#{ bootstrap_kube_api_addr }#"
+    #% for item in bootstrap_kube_additional_tls_sans %#
+    - "{{ item }}"
+    #% endfor %#
+  write-kubeconfig-mode: "644"

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -1,14 +1,12 @@
 ---
-# https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
-# https://github.com/PyratLabs/ansible-role-k3s
 k3s_control_node: false
 k3s_agent:
+  kubelet-arg:
+    - "image-gc-high-threshold=55"
+    - "image-gc-low-threshold=50"
   #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
   node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
   #% else %#
   node-ip: "{{ ansible_host }}"
   #% endif %#
   pause-image: registry.k8s.io/pause:3.9
-  kubelet-arg:
-    - "image-gc-high-threshold=55"
-    - "image-gc-low-threshold=50"

bootstrap/templates/ansible/inventory/hosts.yaml.j2

@@ -5,15 +5,15 @@ kubernetes:
       hosts:
       #% for item in bootstrap_nodes.master %#
         "#{ item.name }#":
-          ansible_user: "#{ item.username }#"
+          ansible_user: "#{ item.ssh.username }#"
           ansible_host: "#{ item.address }#"
       #% endfor %#
-    #% if bootstrap_nodes.worker | length > 0 %#
+    #% if bootstrap_nodes.worker|length > 0 %#
     worker:
       hosts:
       #% for item in bootstrap_nodes.worker %#
         "#{ item.name }#":
-          ansible_user: "#{ item.username }#"
+          ansible_user: "#{ item.ssh.username }#"
           ansible_host: "#{ item.address }#"
       #% endfor %#
     #% endif %#

bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2

@@ -30,10 +30,6 @@
 
     - name: User Configuration
       block:
-        - name: User Configuration | SSH keys
-          ansible.posix.authorized_key:
-            user: "{{ ansible_user }}"
-            key: "https://github.com/#{ bootstrap_github_username }#.keys"
         - name: User Configuration | Silence login
           ansible.builtin.file:
             dest: "{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}/.hushlogin"

bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2

@@ -9,7 +9,7 @@ spec:
     - role: controller+worker
       ssh:
         address: "#{ item.address }#"
-        user: "#{ item.username }#"
+        user: "#{ item.ssh.username }#"
       installFlags:
         - --disable-components=metrics-server
         - --no-taints
@@ -24,12 +24,11 @@ spec:
           after:
             - curl -sfL https://raw.githubusercontent.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#/#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#/kubernetes/k0s/resources/reset-system.sh | bash -s -
     #% endfor %#
-    #% if bootstrap_nodes.worker | length > 0 %#
     #% for item in bootstrap_nodes.worker %#
     - role: worker
       ssh:
         address: "#{ item.address }#"
-        user: "#{ item.username }#"
+        user: "#{ item.ssh.username }#"
       hooks:
         apply:
           before:
@@ -40,7 +39,6 @@ spec:
           after:
             - curl -sfL https://raw.githubusercontent.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#/#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#/kubernetes/k0s/resources/reset-system.sh | bash -s -
     #% endfor %#
-    #% endif %#
   k0s:
     # renovate: datasource=github-releases depName=k0sproject/k0s
     version: v1.28.6+k0s.0
@@ -51,16 +49,14 @@ spec:
           enabled: false
         controllerManager:
           extraArgs:
-            # Required to monitor kube-controller-manager with kube-prometheus-stack
             bind-address: "0.0.0.0"
         scheduler:
           extraArgs:
-            # Required to monitor kube-scheduler with kube-prometheus-stack
             bind-address: "0.0.0.0"
         storage:
           etcd:
             extraArgs:
-              listen-metrics-urls: http://0.0.0.0:2381 # Required to monitor etcd with kube-prometheus-stack
+              listen-metrics-urls: http://0.0.0.0:2381
         api:
           sans:
             #% if bootstrap_kube_api_addr %#

bootstrap/templates/kubernetes/talos/talconfig.yaml.j2

@@ -25,12 +25,18 @@ nodes:
   #% for item in bootstrap_nodes.master %#
   - hostname: "#{ item.name }#"
     ipAddress: "#{ item.address }#"
+    #% if item.talos.disk_device.startswith('/') %#
+    installDisk: "#{ item.talos.disk_device }#"
+    #% else %#
     installDiskSelector:
-      serial: "#{ item.diskSerial }#"
+      serial: "#{ item.talos.disk_device }#"
+    #% endif %#
     controlPlane: true
     networkInterfaces:
       - interface: eth0
         dhcp: false
+        addresses:
+          - "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
         mtu: 1500
         routes:
           - network: 0.0.0.0/0
@@ -38,22 +44,26 @@ nodes:
         vip:
           ip: "#{ bootstrap_kube_api_addr }#"
   #% endfor %#
-  #% if bootstrap_nodes.worker | length > 0 %#
   #% for item in bootstrap_nodes.worker %#
   - hostname: "#{ item.name }#"
     ipAddress: "#{ item.address }#"
+    #% if item.talos.disk_device.startswith('/') %#
+    installDisk: "#{ item.talos.disk_device }#"
+    #% else %#
     installDiskSelector:
-      serial: "#{ item.diskSerial }#"
+      serial: "#{ item.talos.disk_device }#"
+    #% endif %#
     controlPlane: false
     networkInterfaces:
       - interface: eth0
         dhcp: false
+        addresses:
+          - "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
         mtu: 1500
         routes:
           - network: 0.0.0.0/0
             gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
   #% endfor %#
-  #% endif %#
 
 controlPlane:
   patches: