refactor!: project updates (#1326)

* refactor!: flux is required again Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: delimiter that chomps Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: bootstrap_cloudflare logic Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update tests Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: remove last quote Signed-off-by: Devin Buhl <devin@buhl.casa> * chore: update readme Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-02-15 20:03:24 -05:00
1 parent 04ff4ef994
commit c17d543b21
@@ -1 +0,0 @@
-main = lambda data: data.get("flux", {}).get("enabled", False) == True
@@ -1,4 +1,4 @@
-{% if flux.github.private.enabled %}
+#% if bootstrap_github_private_key %#
 ---
 apiVersion: v1
 kind: Secret
@@ -7,11 +7,11 @@ metadata:
  namespace: flux-system
 stringData:
  identity: |
-    {% filter indent(width=4, first=False) %}
-    {{ flux.github.private.key }}
-    {%- endfilter %}
+    #% filter indent(width=4, first=False) %#
+    #{ bootstrap_github_private_key }#
+    #%- endfilter %#
  known_hosts: |
    github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
    github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
    github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
-{% endif %}
+#% endif %#
@@ -0,0 +1 @@
+main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
@@ -0,0 +1,4 @@
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/cilium-values-init.partial.yaml.j2' %#
+#% endfilter %#
@@ -0,0 +1,22 @@
+---
+repositories:
+  - name: cilium
+    url: https://helm.cilium.io
+  - name: postfinance
+    url: https://postfinance.github.io/kubelet-csr-approver
+
+releases:
+  - name: cilium
+    namespace: kube-system
+    chart: cilium/cilium
+    version: 1.15.1
+    wait: true
+    values:
+      - ./cilium-values.yaml
+  - name: kubelet-csr-approver
+    namespace: kube-system
+    chart: postfinance/kubelet-csr-approver
+    version: 1.0.7
+    wait: true
+    values:
+      - ./kubelet-csr-approver-values.yaml
@@ -0,0 +1,4 @@
+---
+#% filter indent(width=0, first=True) %#
+#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
+#% endfilter %#
@@ -0,0 +1,244 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
+---
+# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
+talosVersion: v1.6.4
+# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+kubernetesVersion: v1.29.1
+
+clusterName: &cluster home-kubernetes
+endpoint: https://#{ bootstrap_controllers_vip }#:6443
+clusterPodNets:
+  - "#{ bootstrap_pod_network.split(',')[0] }#"
+clusterSvcNets:
+  - "#{ bootstrap_service_network.split(',')[0] }#"
+additionalApiServerCertSans: &sans
+  - "#{ bootstrap_controllers_vip }#"
+  - 127.0.0.1 # KubePrism
+  #% for item in bootstrap_tls_sans %#
+  - "#{ item }#"
+  #% endfor %#
+additionalMachineCertSans: *sans
+cniConfig:
+  name: none
+
+nodes:
+  #% for item in bootstrap_node_inventory %#
+  - hostname: "#{ item.name }#"
+    ipAddress: "#{ item.address }#"
+    #% if item.talos_disk.startswith('/') %#
+    installDisk: "#{ item.talos_disk }#"
+    #% else %#
+    installDiskSelector:
+      serial: "#{ item.talos_disk }#"
+    #% endif %#
+    #% if bootstrap_talos.secureboot.enabled %#
+    machineSpec:
+      secureboot: true
+    talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }#
+    #% else %#
+    talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#
+    #% endif %#
+    controlPlane: #{ (item.controller) | string | lower }#
+    networkInterfaces:
+      - interface: eth0
+        dhcp: false
+        #% if bootstrap_talos.vlan %#
+        vlans:
+          - vlanId: #{ bootstrap_talos.vlan }#
+            addresses:
+              - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
+            mtu: 1500
+            routes:
+              - network: 0.0.0.0/0
+                #% if bootstrap_node_default_gateway %#
+                gateway: "#{ bootstrap_node_default_gateway }#"
+                #% else %#
+                gateway: "#{ bootstrap_node_network | nthhost(1) }#"
+                #% endif %#
+            #% if item.controller %#
+            vip:
+              ip: "#{ bootstrap_controllers_vip }#"
+            #% endif %#
+        #% else %#
+        addresses:
+          - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
+        mtu: 1500
+        routes:
+          - network: 0.0.0.0/0
+            #% if bootstrap_node_default_gateway %#
+            gateway: "#{ bootstrap_node_default_gateway }#"
+            #% else %#
+            gateway: "#{ bootstrap_node_network | nthhost(1) }#"
+            #% endif %#
+        #% if item.controller %#
+        vip:
+          ip: "#{ bootstrap_controllers_vip }#"
+        #% endif %#
+        #% endif %#
+    #% if bootstrap_talos.user_patches %#
+    patches:
+      - "@./patches/node_#{ item.name }#.yaml"
+    #% endif %#
+  #% endfor %#
+
+patches:
+  # Configure containerd
+  - |-
+    machine:
+      files:
+        - op: create
+          path: /etc/cri/conf.d/20-customization.part
+          content: |-
+            [plugins."io.containerd.grpc.v1.cri"]
+              enable_unprivileged_ports = true
+              enable_unprivileged_icmp = true
+            [plugins."io.containerd.grpc.v1.cri".containerd]
+              discard_unpacked_layers = false
+            [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+              discard_unpacked_layers = false
+
+  # Disable search domain everywhere
+  - |-
+    machine:
+      network:
+        disableSearchDomain: true
+
+  # Enable cluster discovery
+  - |-
+    cluster:
+      discovery:
+        registries:
+          kubernetes:
+            disabled: false
+          service:
+            disabled: false
+
+  # Configure kubelet
+  - |-
+    machine:
+      kubelet:
+        extraArgs:
+          image-gc-low-threshold: 50
+          image-gc-high-threshold: 55
+          rotate-server-certificates: true
+        nodeIP:
+          validSubnets:
+            - "#{ bootstrap_node_network }#"
+
+  # Force nameserver
+  - |-
+    machine:
+      network:
+        nameservers:
+          #% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
+          - #{ item }#
+          #% endfor %#
+
+  # Configure NTP
+  - |-
+    machine:
+      time:
+        disabled: false
+        servers:
+          - time.cloudflare.com
+
+  # Custom sysctl settings
+  - |-
+    machine:
+      sysctls:
+        fs.inotify.max_queued_events: 65536
+        fs.inotify.max_user_watches: 524288
+        fs.inotify.max_user_instances: 8192
+
+  # Mount openebs-hostpath in kubelet
+  - |-
+    machine:
+      kubelet:
+        extraMounts:
+          - destination: /var/openebs/local
+            type: bind
+            source: /var/openebs/local
+            options:
+              - bind
+              - rshared
+              - rw
+
+  # Disable predictable NIC naming
+  - |-
+    machine:
+      install:
+        extraKernelArgs:
+          - net.ifnames=0
+
+  #% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
+  # Encrypt system disk with TPM
+  - |-
+    machine:
+      systemDiskEncryption:
+        ephemeral:
+          provider: luks2
+          keys:
+            - slot: 0
+              tpm: {}
+        state:
+          provider: luks2
+          keys:
+            - slot: 0
+              tpm: {}
+  #% endif %#
+  #% if bootstrap_talos.user_patches %#
+  # User specified global patches
+  - "@./patches/global.yaml"
+  #% endif %#
+
+controlPlane:
+  patches:
+    # Cluster configuration
+    - |-
+      cluster:
+        allowSchedulingOnMasters: true
+        controllerManager:
+          extraArgs:
+            bind-address: 0.0.0.0
+        proxy:
+          disabled: true
+        scheduler:
+          extraArgs:
+            bind-address: 0.0.0.0
+
+    # ETCD configuration
+    - |-
+      cluster:
+        etcd:
+          extraArgs:
+            listen-metrics-urls: http://0.0.0.0:2381
+          advertisedSubnets:
+            - "#{ bootstrap_node_network }#"
+
+    # Disable default API server admission plugins.
+    - |-
+      - op: remove
+        path: /cluster/apiServer/admissionControl
+
+    # Enable K8s Talos API Access
+    - |-
+      machine:
+        features:
+          kubernetesTalosAPIAccess:
+            enabled: true
+            allowedRoles:
+              - os:admin
+            allowedKubernetesNamespaces:
+              - system-upgrade
+
+    #% if bootstrap_talos.user_patches %#
+    # User specified controlPlane patches
+    - "@./patches/controlPlane.yaml"
+    #% endif %#
+
+#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
+worker:
+  patches:
+    # User specified worker patches
+    - "@./patches/worker.yaml"
+#% endif %#
				`@@ -1 +0,0 @@`
				`main = lambda data: data.get("flux", {}).get("enabled", False) == True`
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]`