feat(talos): change from net.ifnames to a macaddr deviceSelector (#1376)

* feat(talos): change from net.ifnames to a macaddr deviceSelector

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: derpge

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: logic is easier to follow now questionmark

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: logic is easier to follow now questionmark

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>

.github/tests/config-talos.yaml

@@ -12,10 +12,12 @@ bootstrap_node_inventory:
     address: 10.10.10.100
     controller: true
     talos_disk: fake
+    talos_nic: fake
   - name: k8s-worker-0
     address: 10.10.10.101
     controller: false
     talos_disk: fake
+    talos_nic: fake
 bootstrap_dns_servers: ["1.1.1.1"]
 bootstrap_search_domain: "fake"
 bootstrap_pod_network: 10.69.0.0/16

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -2,10 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if bootstrap_bgp.enabled %#
-  - ./cilium-bgp.yaml
-  #% endif %#
-  #% if ((not bootstrap_bgp.enabled) and (not bootstrap_feature_gates.dual_stack_ipv4_first)) %#
-  - ./cilium-l2.yaml
-  #% endif %#
   - ./helmrelease.yaml

bootstrap/templates/kubernetes/apps/kube-system/cilium/config/cilium-l2.yaml.j2

@@ -1,14 +1,16 @@
+#% if ((not bootstrap_bgp.enabled) and (not bootstrap_feature_gates.dual_stack_ipv4_first)) %#
 ---
 # https://docs.cilium.io/en/latest/network/l2-announcements
 apiVersion: cilium.io/v2alpha1
 kind: CiliumL2AnnouncementPolicy
 metadata:
-  name: policy
+  name: l2-policy
 spec:
   loadBalancerIPs: true
-  # NOTE: This might need to be set if you have more than one active NIC on your hosts
+  # NOTE: interfaces might need to be set if you have more than one active NIC on your hosts
   # interfaces:
   #   - ^eno[0-9]+
+  #   - ^eth[0-9]+
   nodeSelector:
     matchLabels:
       kubernetes.io/os: linux
@@ -16,7 +18,9 @@ spec:
 apiVersion: cilium.io/v2alpha1
 kind: CiliumLoadBalancerIPPool
 metadata:
-  name: pool
+  name: l2-pool
 spec:
-  cidrs:
+  allowFirstLastIPs: "Yes"
+  blocks:
     - cidr: "${NODE_CIDR}"
+#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/cilium/config/cilium-l3.yaml.j2

@@ -1,9 +1,10 @@
+#% if bootstrap_bgp.enabled %#
 ---
 # https://docs.cilium.io/en/latest/network/bgp-control-plane/
 apiVersion: cilium.io/v2alpha1
 kind: CiliumBGPPeeringPolicy
 metadata:
-  name: policy
+  name: l3-policy
 spec:
   nodeSelector:
     matchLabels:
@@ -31,7 +32,9 @@ spec:
 apiVersion: cilium.io/v2alpha1
 kind: CiliumLoadBalancerIPPool
 metadata:
-  name: pool
+  name: l3-pool
 spec:
-  cidrs:
+  allowFirstLastIPs: "Yes"
+  blocks:
     - cidr: "${BGP_ADVERTISED_CIDR}"
+#% endif %#

bootstrap/templates/kubernetes/apps/kube-system/cilium/config/kustomization.yaml.j2

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  #% if bootstrap_bgp.enabled %#
+  - ./cilium-l3.yaml
+  #% elif not bootstrap_feature_gates.dual_stack_ipv4_first %#
+  - ./cilium-l2.yaml
+  #% else %#
+  []
+  #% endif %#

bootstrap/templates/kubernetes/apps/kube-system/cilium/ks.yaml.j2

@@ -11,6 +11,28 @@ spec:
       app.kubernetes.io/name: *app
   path: ./kubernetes/apps/kube-system/cilium/app
   prune: false # never should be deleted
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cilium-config
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cilium
+  path: ./kubernetes/apps/kube-system/cilium/config
+  prune: false # never should be deleted
   sourceRef:
     kind: GitRepository
     name: home-kubernetes

bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2

@@ -40,7 +40,8 @@ nodes:
     #% endif %#
     controlPlane: #{ (item.controller) | string | lower }#
     networkInterfaces:
-      - interface: eth0
+      - deviceSelector:
+          hardwareAddr: "#{ item.talos_nic }#"
         dhcp: false
         #% if bootstrap_talos.vlan %#
         vlans:
@@ -122,8 +123,7 @@ patches:
           image-gc-high-threshold: 55
           rotate-server-certificates: true
         nodeIP:
-          validSubnets:
+          validSubnets: ["#{ bootstrap_node_network }#"]
-            - "#{ bootstrap_node_network }#"
 
   # Force nameserver
   - |-
@@ -139,8 +139,7 @@ patches:
     machine:
       time:
         disabled: false
-        servers:
+        servers: ["time.cloudflare.com"]
-          - time.cloudflare.com
 
   # Custom sysctl settings
   - |-
@@ -158,17 +157,7 @@ patches:
           - destination: /var/openebs/local
             type: bind
             source: /var/openebs/local
-            options:
+            options: ["bind", "rshared", "rw"]
-              - bind
-              - rshared
-              - rw
-
-  # Disable predictable NIC naming
-  - |-
-    machine:
-      install:
-        extraKernelArgs:
-          - net.ifnames=0
 
   #% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
   # Encrypt system disk with TPM
@@ -186,6 +175,7 @@ patches:
             - slot: 0
               tpm: {}
   #% endif %#
+
   #% if bootstrap_talos.user_patches %#
   # User specified global patches
   - "@./patches/global.yaml"
@@ -226,10 +216,8 @@ controlPlane:
         features:
           kubernetesTalosAPIAccess:
             enabled: true
-            allowedRoles:
+            allowedRoles: ["os:admin"]
-              - os:admin
+            allowedKubernetesNamespaces: ["system-upgrade"]
-            allowedKubernetesNamespaces:
-              - system-upgrade
 
     #% if bootstrap_talos.user_patches %#
     # User specified controlPlane patches

bootstrap/templates/partials/cilium-values-full.partial.yaml.j2

@@ -15,9 +15,8 @@ containerRuntime:
   #% if bootstrap_distribution in ["k3s"] %#
   socketPath: /var/run/k3s/containerd/containerd.sock
   #% endif %#
-# NOTE: This might need to be set if you have more than one active NIC on your hosts
+# NOTE: devices might need to be set if you have more than one active NIC on your hosts
-# devices:
+# devices: eno+ eth+
-#   - eno0
 endpointRoutes:
   enabled: true
 #% if bootstrap_cloudflare.enabled %#

bootstrap/templates/partials/cilium-values-init.partial.yaml.j2

@@ -15,9 +15,8 @@ containerRuntime:
   #% if bootstrap_distribution in ["k3s"] %#
   socketPath: /var/run/k3s/containerd/containerd.sock
   #% endif %#
-# NOTE: This might need to be set if you have more than one active NIC on your hosts
+# NOTE: devices might need to be set if you have more than one active NIC on your hosts
-# devices:
+# devices: eno+ eth+
-#   - eno0
 endpointRoutes:
   enabled: true
 hubble:

config.sample.yaml

@@ -49,7 +49,8 @@ bootstrap_node_inventory: []
     # - name: ""           # (Required) Name of the node (must match [a-z0-9-\.]+)
     #   address: ""        # (Required) IP address of the node
     #   controller: true   # (Required) Set to true if this is a controller node
-    #   talos_disk: ""     # (Required: Talos) Device path or serial number of the disk for this node
+    #   talos_disk: ""     # (Required: Talos) Device path or serial number of the disk for this node (talosctl disks -n <ip> --insecure)
+    #   talos_nic: ""      # (Required: Talos) MAC address of the NIC for this node (talosctl get links -n <ip> --insecure)
     #   ssh_user: ""       # (Required: k3s) SSH username of the node
     #   ssh_key: ""        # (Optional: k3s) Set specific SSH key for this node
     # ...