fix: address talos comments (#1253)

* fix: update cni to cilium in taskfile

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: more updates

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: more cleanup

Signed-off-by: Devin Buhl <devin@buhl.casa>

* chore: housekeeping

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2

@@ -1,14 +1,12 @@
 ---
-# https://github.com/PyratLabs/ansible-role-k3s
-# renovate: datasource=github-releases depName=k3s-io/k3s
-k3s_release_version: v1.29.0+k3s1
-k3s_install_hard_links: true
 k3s_become: true
 k3s_etcd_datastore: true
-k3s_use_unsupported_config: true
+k3s_install_hard_links: true
 k3s_registration_address: "#{ bootstrap_kube_api_addr }#"
-# /var/lib/rancher/k3s/server/manifests
+# renovate: datasource=github-releases depName=k3s-io/k3s
+k3s_release_version: v1.29.0+k3s1
 k3s_server_manifests_templates:
   - custom-cilium-helmchart.yaml
   - kube-vip-ds.yaml
   - kube-vip-rbac.yaml
+k3s_use_unsupported_config: true

bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2

@@ -1,27 +1,6 @@
 ---
-# https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
-# https://github.com/PyratLabs/ansible-role-k3s
 k3s_control_node: true
 k3s_server:
-  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
-  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
-  #% else %#
-  node-ip: "{{ ansible_host }}"
-  #% endif %#
-  tls-san:
-    - "#{ bootstrap_kube_api_addr }#"
-    #% for item in bootstrap_kube_additional_tls_sans %#
-    - "{{ item }}"
-    #% endfor %#
-  docker: false
-  flannel-backend: "none" # quote
-  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
-  disable-network-policy: true
-  disable-cloud-controller: true
-  disable-kube-proxy: true
-  write-kubeconfig-mode: "644"
-  pause-image: registry.k8s.io/pause:3.9
-  secrets-encryption: true
   #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
   cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#"
   service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#"
@@ -29,13 +8,32 @@ k3s_server:
   cluster-cidr: "#{ bootstrap_cluster_cidr }#"
   service-cidr: "#{ bootstrap_service_cidr }#"
   #% endif %#
-  etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack
-  kube-controller-manager-arg:
-    - "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack
-  kube-scheduler-arg:
-    - "bind-address=0.0.0.0" # Required to monitor kube-scheduler with kube-prometheus-stack
+  disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
+  disable-cloud-controller: true
+  disable-kube-proxy: true
+  disable-network-policy: true
+  docker: false
+  etcd-expose-metrics: true
+  flannel-backend: "none"
   kube-apiserver-arg:
-    - "anonymous-auth=true" # Required for external LB health-checks
+    - "anonymous-auth=true"
+  kube-controller-manager-arg:
+    - "bind-address=0.0.0.0"
+  kube-scheduler-arg:
+    - "bind-address=0.0.0.0"
   kubelet-arg:
     - "image-gc-high-threshold=55"
     - "image-gc-low-threshold=50"
+  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
+  #% else %#
+  node-ip: "{{ ansible_host }}"
+  #% endif %#
+  pause-image: registry.k8s.io/pause:3.9
+  secrets-encryption: true
+  tls-san:
+    - "#{ bootstrap_kube_api_addr }#"
+    #% for item in bootstrap_kube_additional_tls_sans %#
+    - "{{ item }}"
+    #% endfor %#
+  write-kubeconfig-mode: "644"

bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2

@@ -1,14 +1,12 @@
 ---
-# https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
-# https://github.com/PyratLabs/ansible-role-k3s
 k3s_control_node: false
 k3s_agent:
+  kubelet-arg:
+    - "image-gc-high-threshold=55"
+    - "image-gc-low-threshold=50"
   #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
   node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
   #% else %#
   node-ip: "{{ ansible_host }}"
   #% endif %#
   pause-image: registry.k8s.io/pause:3.9
-  kubelet-arg:
-    - "image-gc-high-threshold=55"
-    - "image-gc-low-threshold=50"

bootstrap/templates/ansible/inventory/hosts.yaml.j2

@@ -5,15 +5,15 @@ kubernetes:
       hosts:
       #% for item in bootstrap_nodes.master %#
         "#{ item.name }#":
-          ansible_user: "#{ item.username }#"
+          ansible_user: "#{ item.ssh.username }#"
           ansible_host: "#{ item.address }#"
       #% endfor %#
-    #% if bootstrap_nodes.worker | length > 0 %#
+    #% if bootstrap_nodes.worker|length > 0 %#
     worker:
       hosts:
       #% for item in bootstrap_nodes.worker %#
         "#{ item.name }#":
-          ansible_user: "#{ item.username }#"
+          ansible_user: "#{ item.ssh.username }#"
           ansible_host: "#{ item.address }#"
       #% endfor %#
     #% endif %#

bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2

@@ -30,10 +30,6 @@
 
     - name: User Configuration
       block:
-        - name: User Configuration | SSH keys
-          ansible.posix.authorized_key:
-            user: "{{ ansible_user }}"
-            key: "https://github.com/#{ bootstrap_github_username }#.keys"
         - name: User Configuration | Silence login
           ansible.builtin.file:
             dest: "{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}/.hushlogin"