refactor!: project updates (#1326)
* refactor!: flux is required again Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: delimiter that chomps Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: bootstrap_cloudflare logic Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update tests Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: remove last quote Signed-off-by: Devin Buhl <devin@buhl.casa> * chore: update readme Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
04ff4ef994
commit
c17d543b21
93 files changed
+591
-755
No files matched your search
@@ -0,0 +1,244 @@
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
|
||||
---
|
||||
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
|
||||
talosVersion: v1.6.4
|
||||
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
|
||||
kubernetesVersion: v1.29.1
|
||||
|
||||
clusterName: &cluster home-kubernetes
|
||||
endpoint: https://#{ bootstrap_controllers_vip }#:6443
|
||||
clusterPodNets:
|
||||
- "#{ bootstrap_pod_network.split(',')[0] }#"
|
||||
clusterSvcNets:
|
||||
- "#{ bootstrap_service_network.split(',')[0] }#"
|
||||
additionalApiServerCertSans: &sans
|
||||
- "#{ bootstrap_controllers_vip }#"
|
||||
- 127.0.0.1 # KubePrism
|
||||
#% for item in bootstrap_tls_sans %#
|
||||
- "#{ item }#"
|
||||
#% endfor %#
|
||||
additionalMachineCertSans: *sans
|
||||
cniConfig:
|
||||
name: none
|
||||
|
||||
nodes:
|
||||
#% for item in bootstrap_node_inventory %#
|
||||
- hostname: "#{ item.name }#"
|
||||
ipAddress: "#{ item.address }#"
|
||||
#% if item.talos_disk.startswith('/') %#
|
||||
installDisk: "#{ item.talos_disk }#"
|
||||
#% else %#
|
||||
installDiskSelector:
|
||||
serial: "#{ item.talos_disk }#"
|
||||
#% endif %#
|
||||
#% if bootstrap_talos.secureboot.enabled %#
|
||||
machineSpec:
|
||||
secureboot: true
|
||||
talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }#
|
||||
#% else %#
|
||||
talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#
|
||||
#% endif %#
|
||||
controlPlane: #{ (item.controller) | string | lower }#
|
||||
networkInterfaces:
|
||||
- interface: eth0
|
||||
dhcp: false
|
||||
#% if bootstrap_talos.vlan %#
|
||||
vlans:
|
||||
- vlanId: #{ bootstrap_talos.vlan }#
|
||||
addresses:
|
||||
- "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
|
||||
mtu: 1500
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
#% if bootstrap_node_default_gateway %#
|
||||
gateway: "#{ bootstrap_node_default_gateway }#"
|
||||
#% else %#
|
||||
gateway: "#{ bootstrap_node_network | nthhost(1) }#"
|
||||
#% endif %#
|
||||
#% if item.controller %#
|
||||
vip:
|
||||
ip: "#{ bootstrap_controllers_vip }#"
|
||||
#% endif %#
|
||||
#% else %#
|
||||
addresses:
|
||||
- "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
|
||||
mtu: 1500
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
#% if bootstrap_node_default_gateway %#
|
||||
gateway: "#{ bootstrap_node_default_gateway }#"
|
||||
#% else %#
|
||||
gateway: "#{ bootstrap_node_network | nthhost(1) }#"
|
||||
#% endif %#
|
||||
#% if item.controller %#
|
||||
vip:
|
||||
ip: "#{ bootstrap_controllers_vip }#"
|
||||
#% endif %#
|
||||
#% endif %#
|
||||
#% if bootstrap_talos.user_patches %#
|
||||
patches:
|
||||
- "@./patches/node_#{ item.name }#.yaml"
|
||||
#% endif %#
|
||||
#% endfor %#
|
||||
|
||||
patches:
|
||||
# Configure containerd
|
||||
- |-
|
||||
machine:
|
||||
files:
|
||||
- op: create
|
||||
path: /etc/cri/conf.d/20-customization.part
|
||||
content: |-
|
||||
[plugins."io.containerd.grpc.v1.cri"]
|
||||
enable_unprivileged_ports = true
|
||||
enable_unprivileged_icmp = true
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd]
|
||||
discard_unpacked_layers = false
|
||||
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
|
||||
discard_unpacked_layers = false
|
||||
|
||||
# Disable search domain everywhere
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
disableSearchDomain: true
|
||||
|
||||
# Enable cluster discovery
|
||||
- |-
|
||||
cluster:
|
||||
discovery:
|
||||
registries:
|
||||
kubernetes:
|
||||
disabled: false
|
||||
service:
|
||||
disabled: false
|
||||
|
||||
# Configure kubelet
|
||||
- |-
|
||||
machine:
|
||||
kubelet:
|
||||
extraArgs:
|
||||
image-gc-low-threshold: 50
|
||||
image-gc-high-threshold: 55
|
||||
rotate-server-certificates: true
|
||||
nodeIP:
|
||||
validSubnets:
|
||||
- "#{ bootstrap_node_network }#"
|
||||
|
||||
# Force nameserver
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
#% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
|
||||
- #{ item }#
|
||||
#% endfor %#
|
||||
|
||||
# Configure NTP
|
||||
- |-
|
||||
machine:
|
||||
time:
|
||||
disabled: false
|
||||
servers:
|
||||
- time.cloudflare.com
|
||||
|
||||
# Custom sysctl settings
|
||||
- |-
|
||||
machine:
|
||||
sysctls:
|
||||
fs.inotify.max_queued_events: 65536
|
||||
fs.inotify.max_user_watches: 524288
|
||||
fs.inotify.max_user_instances: 8192
|
||||
|
||||
# Mount openebs-hostpath in kubelet
|
||||
- |-
|
||||
machine:
|
||||
kubelet:
|
||||
extraMounts:
|
||||
- destination: /var/openebs/local
|
||||
type: bind
|
||||
source: /var/openebs/local
|
||||
options:
|
||||
- bind
|
||||
- rshared
|
||||
- rw
|
||||
|
||||
# Disable predictable NIC naming
|
||||
- |-
|
||||
machine:
|
||||
install:
|
||||
extraKernelArgs:
|
||||
- net.ifnames=0
|
||||
|
||||
#% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
|
||||
# Encrypt system disk with TPM
|
||||
- |-
|
||||
machine:
|
||||
systemDiskEncryption:
|
||||
ephemeral:
|
||||
provider: luks2
|
||||
keys:
|
||||
- slot: 0
|
||||
tpm: {}
|
||||
state:
|
||||
provider: luks2
|
||||
keys:
|
||||
- slot: 0
|
||||
tpm: {}
|
||||
#% endif %#
|
||||
#% if bootstrap_talos.user_patches %#
|
||||
# User specified global patches
|
||||
- "@./patches/global.yaml"
|
||||
#% endif %#
|
||||
|
||||
controlPlane:
|
||||
patches:
|
||||
# Cluster configuration
|
||||
- |-
|
||||
cluster:
|
||||
allowSchedulingOnMasters: true
|
||||
controllerManager:
|
||||
extraArgs:
|
||||
bind-address: 0.0.0.0
|
||||
proxy:
|
||||
disabled: true
|
||||
scheduler:
|
||||
extraArgs:
|
||||
bind-address: 0.0.0.0
|
||||
|
||||
# ETCD configuration
|
||||
- |-
|
||||
cluster:
|
||||
etcd:
|
||||
extraArgs:
|
||||
listen-metrics-urls: http://0.0.0.0:2381
|
||||
advertisedSubnets:
|
||||
- "#{ bootstrap_node_network }#"
|
||||
|
||||
# Disable default API server admission plugins.
|
||||
- |-
|
||||
- op: remove
|
||||
path: /cluster/apiServer/admissionControl
|
||||
|
||||
# Enable K8s Talos API Access
|
||||
- |-
|
||||
machine:
|
||||
features:
|
||||
kubernetesTalosAPIAccess:
|
||||
enabled: true
|
||||
allowedRoles:
|
||||
- os:admin
|
||||
allowedKubernetesNamespaces:
|
||||
- system-upgrade
|
||||
|
||||
#% if bootstrap_talos.user_patches %#
|
||||
# User specified controlPlane patches
|
||||
- "@./patches/controlPlane.yaml"
|
||||
#% endif %#
|
||||
|
||||
#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
|
||||
worker:
|
||||
patches:
|
||||
# User specified worker patches
|
||||
- "@./patches/worker.yaml"
|
||||
#% endif %#
|
||||
Reference in new issue
Block a user