feat: add talos support (#1192)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-19 05:36:25 -05:00
1 parent cec32120db
commit 91d8b84f3c
@@ -0,0 +1,31 @@
+#% if bootstrap_distribution == 'talos' %#
+# Bootstrap
+
+## Talos
+
+### 1. Create Talos Secrets
+
+```sh
+task talos:gensecret
+task talos:genconfig
+```
+
+### 2. Apply Talos Config
+
+```sh
+task talos:apply-config
+```
+
+### 3. Boostrap Talos and get kubeconfig
+
+```sh
+task talos:bootstrap
+task talos:kubeconfig
+```
+
+### 4. Install Cilium and kubelet-csr-approver into the cluster
+
+```sh
+task talos:apply-extras
+```
+#% endif %#
@@ -0,0 +1,3 @@
+#% if bootstrap_distribution == 'talos' %#
+charts/
+#% endif %#
@@ -0,0 +1,17 @@
+#% if bootstrap_distribution == 'talos' %#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: cilium
+    repo: https://helm.cilium.io
+    version: 1.14.5
+    releaseName: cilium
+    namespace: kube-system
+    valuesFile: values.yaml
+commonAnnotations:
+  meta.helm.sh/release-name: cilium
+  meta.helm.sh/release-namespace: kube-system
+commonLabels:
+  app.kubernetes.io/managed-by: Helm
+#% endif %#
@@ -0,0 +1,6 @@
+#% if bootstrap_distribution == 'talos' %#
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/cilium-values-init.partial.yaml.j2' %#
+#% endfilter %#
+#% endif %#
@@ -0,0 +1,3 @@
+#% if bootstrap_distribution == 'talos' %#
+charts/
+#% endif %#
@@ -0,0 +1,20 @@
+#% if bootstrap_distribution == 'talos' %#
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+helmCharts:
+  - name: kubelet-csr-approver
+    repo: https://postfinance.github.io/kubelet-csr-approver
+    version: 1.0.6
+    releaseName: kubelet-csr-approver
+    namespace: kube-system
+    valuesInline:
+      providerRegex: ^k(m|w)\d\d?$
+      bypassDnsResolution: true
+commonAnnotations:
+  meta.helm.sh/release-name: kubelet-csr-approver
+  meta.helm.sh/release-namespace: kube-system
+commonLabels:
+  app.kubernetes.io/managed-by: Helm
+#% endif %#
@@ -0,0 +1,192 @@
+#% if bootstrap_distribution == 'talos' %#
+# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
+---
+# renovate: datasource=github-releases depName=siderolabs/talos
+talosVersion: v1.6.1
+# renovate: datasource=github-releases depName=kubernetes/kubernetes extractVersion=^v(?<version>.*)$
+kubernetesVersion: 1.29.1
+
+clusterName: &cluster home-kubernetes
+
+#% if bootstrap_kube_api_hostname | default('') %#
+endpoint: https://#{ bootstrap_kube_api_hostname }#:6443
+#% else %#
+endpoint: https://#{ bootstrap_kube_api_addr }#:6443
+#% endif %#
+
+clusterPodNets:
+  - "#{ bootstrap_cluster_cidr.split(',')[0] }#"
+clusterSvcNets:
+  - "#{ bootstrap_service_cidr.split(',')[0] }#"
+
+additionalApiServerCertSans: &sans
+  - "#{ bootstrap_kube_api_addr }#"
+  - 127.0.0.1 #KubePrism
+  #% if bootstrap_kube_api_hostname | default('') %#
+  - "#{ bootstrap_kube_api_hostname }#"
+  #% endif %#
+
+additionalMachineCertSans: *sans
+
+cniConfig:
+  name: none
+
+nodes:
+  #% for item in bootstrap_nodes.master %#
+  - hostname: "#{ item.name }#"
+    ipAddress: "#{ item.address }#"
+    installDiskSelector:
+      serial: "#{ item.diskSerial }#"
+    controlPlane: true
+    networkInterfaces:
+      - interface: eth0
+        dhcp: false
+        mtu: 1500
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
+        vip:
+          ip: "#{ bootstrap_kube_api_addr }#"
+  #% endfor %#
+  #% if bootstrap_nodes.worker | default([]) | length > 0 %#
+  #% for item in bootstrap_nodes.worker %#
+  - hostname: "#{ item.name }#"
+    ipAddress: "#{ item.address }#"
+    installDiskSelector:
+      serial: "#{ item.diskSerial }#"
+    controlPlane: false
+    networkInterfaces:
+      - interface: eth0
+        dhcp: false
+        mtu: 1500
+        routes:
+          - network: 0.0.0.0/0
+            gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
+  #% endfor %#
+  #% endif %#
+
+controlPlane:
+  patches:
+    # Configure containerd
+    - &containerdPatch |-
+      machine:
+        files:
+          - op: create
+            path: /etc/cri/conf.d/20-customization.part
+            content: |-
+              [plugins."io.containerd.grpc.v1.cri"]
+                enable_unprivileged_ports = true
+                enable_unprivileged_icmp = true
+              #% if spegel.enabled | default(false) %#
+              [plugins."io.containerd.grpc.v1.cri".containerd]
+                discard_unpacked_layers = false
+              [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+                discard_unpacked_layers = false
+              #% endif %#
+
+    # Disable search domain everywhere
+    - &disableSearchDomainPatch |-
+      machine:
+        network:
+          disableSearchDomain: true
+
+    # Enable cluster discovery
+    - &discoveryPatch |-
+      cluster:
+        discovery:
+          registries:
+            kubernetes:
+              disabled: false
+            service:
+              disabled: false
+
+    # Configure kubelet
+    - &kubeletPatch |-
+      machine:
+        kubelet:
+          extraArgs:
+            rotate-server-certificates: true
+          nodeIP:
+            validSubnets:
+              - "#{ bootstrap_node_cidr }#"
+
+    # Enable KubePrism
+    - &kubePrismPatch |-
+      machine:
+        features:
+          kubePrism:
+            enabled: true
+            port: 7445
+
+    # Force nameserver
+    - &nameserverPatch |-
+      machine:
+        network:
+          nameservers:
+            - 1.1.1.1
+
+    # Configure NTP
+    - &ntpPatch |-
+      machine:
+        time:
+          disabled: false
+          servers:
+            - time.cloudflare.com
+
+    # Custom sysctl settings
+    - &sysctlPatch |-
+      machine:
+        sysctls:
+          fs.inotify.max_queued_events: 65536
+          fs.inotify.max_user_watches: 524288
+          fs.inotify.max_user_instances: 8192
+
+    # Cluster configuration
+    - |-
+      cluster:
+        allowSchedulingOnMasters: true
+        controllerManager:
+          extraArgs:
+            bind-address: 0.0.0.0
+        proxy:
+          disabled: true
+        scheduler:
+          extraArgs:
+            bind-address: 0.0.0.0
+
+    # ETCD configuration
+    - |-
+      cluster:
+        etcd:
+          extraArgs:
+            listen-metrics-urls: http://0.0.0.0:2381
+          advertisedSubnets:
+            - "#{ bootstrap_node_cidr }#"
+
+    # Disable default API server admission plugins.
+    - |-
+      - op: remove
+        path: /cluster/apiServer/admissionControl
+
+    # Enable K8s Talos API Access
+    - |-
+      machine:
+        features:
+          kubernetesTalosAPIAccess:
+            enabled: true
+            allowedRoles:
+              - os:admin
+            allowedKubernetesNamespaces:
+              - kube-system
+
+worker:
+  patches:
+    - *containerdPatch
+    - *disableSearchDomainPatch
+    - *discoveryPatch
+    - *kubeletPatch
+    - *kubePrismPatch
+    - *nameserverPatch
+    - *ntpPatch
+    - *sysctlPatch
+#% endif %#