feat: add talos support (#1192)
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
cec32120db
commit
91d8b84f3c
33 files changed
+537
-42
No files matched your search
@@ -1,5 +1,10 @@
|
||||
---
|
||||
creation_rules:
|
||||
- # IMPORTANT: This rule MUST be above the others
|
||||
path_regex: talos/.*\.sops\.ya?ml
|
||||
key_groups:
|
||||
- age:
|
||||
- "#{ bootstrap_age_public_key }#"
|
||||
- path_regex: kubernetes/.*\.sops\.ya?ml
|
||||
encrypted_regex: "^(data|stringData)$"
|
||||
key_groups:
|
||||
|
||||
@@ -7,11 +7,7 @@ kubernetes:
|
||||
#% for item in bootstrap_nodes.master %#
|
||||
"#{ item.name }#":
|
||||
ansible_user: "#{ item.username }#"
|
||||
#% if item.external_address is defined %#
|
||||
ansible_host: "#{ item.external_address }#"
|
||||
#% else %#
|
||||
ansible_host: "#{ item.address }#"
|
||||
#% endif %#
|
||||
#% endfor %#
|
||||
#% if bootstrap_nodes.worker | default([]) | length > 0 %#
|
||||
worker:
|
||||
@@ -19,11 +15,7 @@ kubernetes:
|
||||
#% for item in bootstrap_nodes.worker %#
|
||||
"#{ item.name }#":
|
||||
ansible_user: "#{ item.username }#"
|
||||
#% if item.external_address is defined %#
|
||||
ansible_host: "#{ item.external_address }#"
|
||||
#% else %#
|
||||
ansible_host: "#{ item.address }#"
|
||||
#% endif %#
|
||||
#% endfor %#
|
||||
#% endif %#
|
||||
#% endif %#
|
||||
+29
@@ -0,0 +1,29 @@
|
||||
#% if bootstrap_distribution == "talos" %#
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kubelet-csr-approver
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: kubelet-csr-approver
|
||||
version: 1.0.6
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: postfinance
|
||||
namespace: flux-system
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
providerRegex: |
|
||||
^k(m|w)\d\d?$
|
||||
#% endif %#
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
#% if bootstrap_distribution == "talos" %#
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
#% endif %#
|
||||
@@ -0,0 +1,22 @@
|
||||
#% if bootstrap_distribution == "talos" %#
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: &app kubelet-csr-approver
|
||||
namespace: flux-system
|
||||
spec:
|
||||
targetNamespace: kube-system
|
||||
commonMetadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: *app
|
||||
path: ./kubernetes/apps/kube-system/kubelet-csr-approver/app
|
||||
prune: false # never should be deleted
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
#% endif %#
|
||||
@@ -7,7 +7,10 @@ resources:
|
||||
#% if bootstrap_distribution == "k3s" %#
|
||||
- ./coredns/ks.yaml
|
||||
#% endif %#
|
||||
#% if bootstrap_distribution == "talos" %#
|
||||
- ./kubelet-csr-approver/ks.yaml
|
||||
#% endif %#
|
||||
- ./metrics-server/ks.yaml
|
||||
#% if bootstrap_distribution == "k0s" and spegel.enabled | default(false) %#
|
||||
#% if (bootstrap_distribution == "k0s" or bootstrap_distribution == "talos") and spegel.enabled | default(false) %#
|
||||
- ./spegel/ks.yaml
|
||||
#% endif %#
|
||||
@@ -1,4 +1,4 @@
|
||||
#% if bootstrap_distribution == "k0s" and spegel.enabled | default(false) %#
|
||||
#% if (bootstrap_distribution == "k0s" or bootstrap_distribution == "talos") and spegel.enabled | default(false) %#
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#% if bootstrap_distribution == "k0s" and spegel.enabled | default(false) %#
|
||||
#% if (bootstrap_distribution == "k0s" or bootstrap_distribution == "talos") and spegel.enabled | default(false) %#
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#% if bootstrap_distribution == "k0s" and spegel.enabled | default(false) %#
|
||||
#% if (bootstrap_distribution == "k0s" or bootstrap_distribution == "talos") and spegel.enabled | default(false) %#
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
|
||||
@@ -18,6 +18,7 @@ resources:
|
||||
- ./metrics-server.yaml
|
||||
- ./openebs.yaml
|
||||
- ./piraeus.yaml
|
||||
- ./postfinance.yaml
|
||||
- ./prometheus-community.yaml
|
||||
- ./stakater.yaml
|
||||
- ./weave-gitops.yaml
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: postfinance
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://postfinance.github.io/kubelet-csr-approver
|
||||
@@ -0,0 +1,31 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
# Bootstrap
|
||||
|
||||
## Talos
|
||||
|
||||
### 1. Create Talos Secrets
|
||||
|
||||
```sh
|
||||
task talos:gensecret
|
||||
task talos:genconfig
|
||||
```
|
||||
|
||||
### 2. Apply Talos Config
|
||||
|
||||
```sh
|
||||
task talos:apply-config
|
||||
```
|
||||
|
||||
### 3. Boostrap Talos and get kubeconfig
|
||||
|
||||
```sh
|
||||
task talos:bootstrap
|
||||
task talos:kubeconfig
|
||||
```
|
||||
|
||||
### 4. Install Cilium and kubelet-csr-approver into the cluster
|
||||
|
||||
```sh
|
||||
task talos:apply-extras
|
||||
```
|
||||
#% endif %#
|
||||
@@ -0,0 +1,3 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
charts/
|
||||
#% endif %#
|
||||
@@ -0,0 +1,17 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
helmCharts:
|
||||
- name: cilium
|
||||
repo: https://helm.cilium.io
|
||||
version: 1.14.5
|
||||
releaseName: cilium
|
||||
namespace: kube-system
|
||||
valuesFile: values.yaml
|
||||
commonAnnotations:
|
||||
meta.helm.sh/release-name: cilium
|
||||
meta.helm.sh/release-namespace: kube-system
|
||||
commonLabels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
#% endif %#
|
||||
@@ -0,0 +1,6 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
---
|
||||
#% filter indent(width=0, first=True) %#
|
||||
#% include 'partials/cilium-values-init.partial.yaml.j2' %#
|
||||
#% endfilter %#
|
||||
#% endif %#
|
||||
@@ -0,0 +1,3 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
charts/
|
||||
#% endif %#
|
||||
@@ -0,0 +1,20 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
helmCharts:
|
||||
- name: kubelet-csr-approver
|
||||
repo: https://postfinance.github.io/kubelet-csr-approver
|
||||
version: 1.0.6
|
||||
releaseName: kubelet-csr-approver
|
||||
namespace: kube-system
|
||||
valuesInline:
|
||||
providerRegex: ^k(m|w)\d\d?$
|
||||
bypassDnsResolution: true
|
||||
commonAnnotations:
|
||||
meta.helm.sh/release-name: kubelet-csr-approver
|
||||
meta.helm.sh/release-namespace: kube-system
|
||||
commonLabels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
#% endif %#
|
||||
@@ -0,0 +1,192 @@
|
||||
#% if bootstrap_distribution == 'talos' %#
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
|
||||
---
|
||||
# renovate: datasource=github-releases depName=siderolabs/talos
|
||||
talosVersion: v1.6.1
|
||||
# renovate: datasource=github-releases depName=kubernetes/kubernetes extractVersion=^v(?<version>.*)$
|
||||
kubernetesVersion: 1.29.1
|
||||
|
||||
clusterName: &cluster home-kubernetes
|
||||
|
||||
#% if bootstrap_kube_api_hostname | default('') %#
|
||||
endpoint: https://#{ bootstrap_kube_api_hostname }#:6443
|
||||
#% else %#
|
||||
endpoint: https://#{ bootstrap_kube_api_addr }#:6443
|
||||
#% endif %#
|
||||
|
||||
clusterPodNets:
|
||||
- "#{ bootstrap_cluster_cidr.split(',')[0] }#"
|
||||
clusterSvcNets:
|
||||
- "#{ bootstrap_service_cidr.split(',')[0] }#"
|
||||
|
||||
additionalApiServerCertSans: &sans
|
||||
- "#{ bootstrap_kube_api_addr }#"
|
||||
- 127.0.0.1 #KubePrism
|
||||
#% if bootstrap_kube_api_hostname | default('') %#
|
||||
- "#{ bootstrap_kube_api_hostname }#"
|
||||
#% endif %#
|
||||
|
||||
additionalMachineCertSans: *sans
|
||||
|
||||
cniConfig:
|
||||
name: none
|
||||
|
||||
nodes:
|
||||
#% for item in bootstrap_nodes.master %#
|
||||
- hostname: "#{ item.name }#"
|
||||
ipAddress: "#{ item.address }#"
|
||||
installDiskSelector:
|
||||
serial: "#{ item.diskSerial }#"
|
||||
controlPlane: true
|
||||
networkInterfaces:
|
||||
- interface: eth0
|
||||
dhcp: false
|
||||
mtu: 1500
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
|
||||
vip:
|
||||
ip: "#{ bootstrap_kube_api_addr }#"
|
||||
#% endfor %#
|
||||
#% if bootstrap_nodes.worker | default([]) | length > 0 %#
|
||||
#% for item in bootstrap_nodes.worker %#
|
||||
- hostname: "#{ item.name }#"
|
||||
ipAddress: "#{ item.address }#"
|
||||
installDiskSelector:
|
||||
serial: "#{ item.diskSerial }#"
|
||||
controlPlane: false
|
||||
networkInterfaces:
|
||||
- interface: eth0
|
||||
dhcp: false
|
||||
mtu: 1500
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
|
||||
#% endfor %#
|
||||
#% endif %#
|
||||
|
||||
controlPlane:
|
||||
patches:
|
||||
# Configure containerd
|
||||
- &containerdPatch |-
|
||||
machine:
|
||||
files:
|
||||
- op: create
|
||||
path: /etc/cri/conf.d/20-customization.part
|
||||
content: |-
|
||||
[plugins."io.containerd.grpc.v1.cri"]
|
||||
enable_unprivileged_ports = true
|
||||
enable_unprivileged_icmp = true
|
||||
#% if spegel.enabled | default(false) %#
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd]
|
||||
discard_unpacked_layers = false
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
|
||||
discard_unpacked_layers = false
|
||||
#% endif %#
|
||||
|
||||
# Disable search domain everywhere
|
||||
- &disableSearchDomainPatch |-
|
||||
machine:
|
||||
network:
|
||||
disableSearchDomain: true
|
||||
|
||||
# Enable cluster discovery
|
||||
- &discoveryPatch |-
|
||||
cluster:
|
||||
discovery:
|
||||
registries:
|
||||
kubernetes:
|
||||
disabled: false
|
||||
service:
|
||||
disabled: false
|
||||
|
||||
# Configure kubelet
|
||||
- &kubeletPatch |-
|
||||
machine:
|
||||
kubelet:
|
||||
extraArgs:
|
||||
rotate-server-certificates: true
|
||||
nodeIP:
|
||||
validSubnets:
|
||||
- "#{ bootstrap_node_cidr }#"
|
||||
|
||||
# Enable KubePrism
|
||||
- &kubePrismPatch |-
|
||||
machine:
|
||||
features:
|
||||
kubePrism:
|
||||
enabled: true
|
||||
port: 7445
|
||||
|
||||
# Force nameserver
|
||||
- &nameserverPatch |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 1.1.1.1
|
||||
|
||||
# Configure NTP
|
||||
- &ntpPatch |-
|
||||
machine:
|
||||
time:
|
||||
disabled: false
|
||||
servers:
|
||||
- time.cloudflare.com
|
||||
|
||||
# Custom sysctl settings
|
||||
- &sysctlPatch |-
|
||||
machine:
|
||||
sysctls:
|
||||
fs.inotify.max_queued_events: 65536
|
||||
fs.inotify.max_user_watches: 524288
|
||||
fs.inotify.max_user_instances: 8192
|
||||
|
||||
# Cluster configuration
|
||||
- |-
|
||||
cluster:
|
||||
allowSchedulingOnMasters: true
|
||||
controllerManager:
|
||||
extraArgs:
|
||||
bind-address: 0.0.0.0
|
||||
proxy:
|
||||
disabled: true
|
||||
scheduler:
|
||||
extraArgs:
|
||||
bind-address: 0.0.0.0
|
||||
|
||||
# ETCD configuration
|
||||
- |-
|
||||
cluster:
|
||||
etcd:
|
||||
extraArgs:
|
||||
listen-metrics-urls: http://0.0.0.0:2381
|
||||
advertisedSubnets:
|
||||
- "#{ bootstrap_node_cidr }#"
|
||||
|
||||
# Disable default API server admission plugins.
|
||||
- |-
|
||||
- op: remove
|
||||
path: /cluster/apiServer/admissionControl
|
||||
|
||||
# Enable K8s Talos API Access
|
||||
- |-
|
||||
machine:
|
||||
features:
|
||||
kubernetesTalosAPIAccess:
|
||||
enabled: true
|
||||
allowedRoles:
|
||||
- os:admin
|
||||
allowedKubernetesNamespaces:
|
||||
- kube-system
|
||||
|
||||
worker:
|
||||
patches:
|
||||
- *containerdPatch
|
||||
- *disableSearchDomainPatch
|
||||
- *discoveryPatch
|
||||
- *kubeletPatch
|
||||
- *kubePrismPatch
|
||||
- *nameserverPatch
|
||||
- *ntpPatch
|
||||
- *sysctlPatch
|
||||
#% endif %#
|
||||
@@ -70,6 +70,9 @@ k8sServicePort: 6444
|
||||
#% elif bootstrap_distribution == "k0s" %#
|
||||
k8sServiceHost: localhost
|
||||
k8sServicePort: 7443
|
||||
#% elif bootstrap_distribution == "talos" %#
|
||||
k8sServiceHost: localhost
|
||||
k8sServicePort: 7445
|
||||
#% endif %#
|
||||
kubeProxyReplacement: true
|
||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||
|
||||
@@ -31,6 +31,9 @@ k8sServicePort: 6444
|
||||
#% elif bootstrap_distribution == "k0s" %#
|
||||
k8sServiceHost: localhost
|
||||
k8sServicePort: 7443
|
||||
#% elif bootstrap_distribution == "talos" %#
|
||||
k8sServiceHost: localhost
|
||||
k8sServicePort: 7445
|
||||
#% endif %#
|
||||
kubeProxyReplacement: true
|
||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||
|
||||
Reference in new issue
Block a user