refactor!: project updates (#1326)
* refactor!: flux is required again Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: delimiter that chomps Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: bootstrap_cloudflare logic Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update tests Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: remove last quote Signed-off-by: Devin Buhl <devin@buhl.casa> * chore: update readme Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
04ff4ef994
commit
c17d543b21
93 files changed
+591
-755
No files matched your search
+135
-147
@@ -1,161 +1,149 @@
|
||||
---
|
||||
|
||||
#
|
||||
# (Required) Distribution represents the Kubernetes distribution layer and any additional customizations
|
||||
# 1. (Required) Cluster details - Cluster represents the Kubernetes cluster layer and any additional customizations
|
||||
#
|
||||
|
||||
distribution:
|
||||
# (Required) Distribution can either be k3s, or talos
|
||||
type: k3s
|
||||
# (Optional) Talos Specific Options
|
||||
talos: {}
|
||||
# # (Required) If you need any additional System Extensions and/or kernel arguments generate a schematic ID.
|
||||
# # Go to https://factory.talos.dev/ and choose the System Extensions you need and/or add extra kernel arguments.
|
||||
# # Otherwise use below default.
|
||||
# schematicID: "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
# # (Optional) Add vlan tag to network master device
|
||||
# # See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans
|
||||
# vlan: 1
|
||||
# # (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments.
|
||||
# # Needs a BGP capable router setup with the node IPs as peers.
|
||||
# # See: https://docs.cilium.io/en/latest/network/bgp-control-plane/
|
||||
# bgp:
|
||||
# enabled: true
|
||||
# # (Optional) If using multiple BGP peers add them here.
|
||||
# # Default is .1 derrived from host_network: ['x.x.x.1']
|
||||
# peers: []
|
||||
# # (Required) Set the BGP Autonomous System Number for the router(s) and nodes.
|
||||
# # If these match, iBGP will be used. If not, eBGP will be used.
|
||||
# peer_asn: 64512 # Router(s) AS
|
||||
# local_asn: 64512 # Node(s) AS
|
||||
# # (Required) The loadbalancer CIDR for the cluster, this must NOT overlap with any
|
||||
# # existing networks and is usually a /16 (64K IPs).
|
||||
# # If you want to use IPv6 check the advanced flags below
|
||||
# loadbalancer_network: 10.123.0.0/16
|
||||
# secureboot:
|
||||
# # (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
|
||||
# # If you want to use this. Please make sure to boot from secureboot ISO and enroll keys first.
|
||||
# # See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot
|
||||
# enabled: true
|
||||
# # (Optional) Enable TPM-based disk encryption. Requires TPM 2.0
|
||||
# # See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm
|
||||
# encrypt_disk_with_tpm: true
|
||||
# user_patches: true
|
||||
# # (Optional) Add includes for user provided patches to generated talconfig.yaml.
|
||||
# # See: https://github.com/budimanjojo/talhelper/blob/179ba9ed42f70069c7842109bea24f769f7af6eb/example/extraKernelArgs-patch.yaml
|
||||
# # Patches are applied in this order. (global overrides cp/worker which overrides node-specific).
|
||||
# # Create these files to allow talos:bootstrap-genconfig to complete (empty files are ok).
|
||||
# # kubernetes/talos/patches/node_<name>.yaml # Patches for individual nodes
|
||||
# # kubernetes/talos/patches/controlPlane.yaml # Patches for controlplane nodes
|
||||
# # kubernetes/talos/patches/worker.yaml # Patches for worker nodes
|
||||
# # kubernetes/talos/patches/global.yaml # Patches for ALL nodes
|
||||
|
||||
#
|
||||
# (Required) Timezone is your IANA formatted timezone (e.g. America/New_York)
|
||||
#
|
||||
bootstrap_timezone: ""
|
||||
|
||||
timezone: ""
|
||||
# (Required) Distribution can either be k3s or talos
|
||||
bootstrap_distribution: k3s
|
||||
|
||||
#
|
||||
# (Required) Nodes represents the physical or virtual machines layer and any additional customizations
|
||||
#
|
||||
# (Required: Talos) Talos Specific Options
|
||||
bootstrap_talos:
|
||||
# (Required: Talos) If you need any additional System Extensions, and/or add kernel arguments generate a schematic ID.
|
||||
# Go to https://factory.talos.dev/ and choose the System Extensions, and/or add kernel arguments.
|
||||
schematic_id: ""
|
||||
# (Optional: Talos) Add vlan tag to network master device
|
||||
# See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans
|
||||
vlan: ""
|
||||
# (Optional: Talos) Secureboot and TPM-based disk encryption
|
||||
secureboot:
|
||||
# (Optional) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
|
||||
# See: https://www.talos.dev/latest/talos-guides/install/bare-metal-platforms/secureboot
|
||||
enabled: false
|
||||
# (Optional) Enable TPM-based disk encryption. Requires TPM 2.0
|
||||
# See: https://www.talos.dev/v1.6/talos-guides/install/bare-metal-platforms/secureboot/#disk-encryption-with-tpm
|
||||
encrypt_disk_with_tpm: false
|
||||
# (Optional) Add includes for user provided patches to generated talconfig.yaml.
|
||||
# See: https://github.com/budimanjojo/talhelper/blob/179ba9ed42f70069c7842109bea24f769f7af6eb/example/extraKernelArgs-patch.yaml
|
||||
# Patches are applied in this order. (global overrides cp/worker which overrides node-specific).
|
||||
# Create these files to allow talos:bootstrap-genconfig to complete (empty files are ok).
|
||||
# kubernetes/talos/patches/node_<name>.yaml # Patches for individual nodes
|
||||
# kubernetes/talos/patches/controlPlane.yaml # Patches for controlplane nodes
|
||||
# kubernetes/talos/patches/worker.yaml # Patches for worker nodes
|
||||
# kubernetes/talos/patches/global.yaml # Patches for ALL nodes
|
||||
user_patches: false
|
||||
|
||||
nodes:
|
||||
# (Required) CIDR your nodes are on (e.g. 192.168.1.0/24)
|
||||
host_network: ""
|
||||
# (Optional) Talos only: If your gateway is not on the .1 address of above CIDR you can set it here (e.g. 192.168.1.254)
|
||||
# default_gateway: ""
|
||||
# (Optional) The DNS server to use for the cluster, this can be an existing
|
||||
# local DNS server or a public one.
|
||||
# Default is ["1.1.1.1", "1.0.0.1"]
|
||||
# If using a local DNS server make sure it meets the following requirements:
|
||||
# 1. your nodes can reach it
|
||||
# 2. it is configured to forward requests to a public DNS server
|
||||
# 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
|
||||
# If using multiple DNS servers make sure they are setup the same way, there is no
|
||||
# guarantee that the first DNS server will always be used for every lookup.
|
||||
dns_servers: []
|
||||
# (Optional) The DNS search domain to use for the nodes.
|
||||
# Default is "."
|
||||
# Use the default or leave empty to avoid possible DNS issues inside the cluster.
|
||||
search_domain: ""
|
||||
# (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3
|
||||
# Worker nodes are optional
|
||||
inventory: []
|
||||
# - name: "" # Name of the node (must match [a-z0-9-\.]+)
|
||||
# address: "" # IP address of the node
|
||||
# controller: true # (Required) Set to true if this is a controller node
|
||||
# ssh_username: "" # (Required: k3s) SSH username of the node
|
||||
# talos_disk_device: "" # (Required: Talos) Device path or serial number of the disk for this node
|
||||
# (Required) The CIDR your nodes are on (e.g. 192.168.1.0/24)
|
||||
bootstrap_node_network: ""
|
||||
|
||||
# (Optional) The default gateway for the nodes
|
||||
# Default is .1 derrived from bootstrap_node_network: 'x.x.x.1'
|
||||
bootstrap_node_default_gateway: ""
|
||||
|
||||
# (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3
|
||||
# Worker nodes are optional
|
||||
bootstrap_node_inventory: []
|
||||
# - name: "" # Name of the node (must match [a-z0-9-\.]+)
|
||||
# address: "" # IP address of the node
|
||||
# controller: true # (Required) Set to true if this is a controller node
|
||||
# ssh_user: "" # (Required: k3s) SSH username of the node
|
||||
# talos_disk: "" # (Required: Talos) Device path or serial number of the disk for this node
|
||||
# ...
|
||||
|
||||
#
|
||||
# (Required) Cluster represents the Kubernetes cluster layer and any additional customizations
|
||||
#
|
||||
# (Optional) The DNS server to use for the cluster, this can be an existing
|
||||
# local DNS server or a public one.
|
||||
# Default is ["1.1.1.1", "1.0.0.1"]
|
||||
# If using a local DNS server make sure it meets the following requirements:
|
||||
# 1. your nodes can reach it
|
||||
# 2. it is configured to forward requests to a public DNS server
|
||||
# 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
|
||||
# If using multiple DNS servers make sure they are setup the same way, there is no
|
||||
# guarantee that the first DNS server will always be used for every lookup.
|
||||
bootstrap_dns_servers: []
|
||||
|
||||
cluster:
|
||||
# (Required) The pod CIDR for the cluster, this must NOT overlap with any
|
||||
# existing networks and is usually a /16 (64K IPs).
|
||||
# If you want to use IPv6 check the advanced flags below
|
||||
pod_network: 10.69.0.0/16
|
||||
# (Required) The service CIDR for the cluster, this must NOT overlap with any
|
||||
# existing networks and is usually a /16 (64K IPs).
|
||||
# If you want to use IPv6 check the advanced flags below
|
||||
service_network: 10.96.0.0/16
|
||||
# (Required) The IP address of the Kube API, choose an available IP in
|
||||
# your nodes host network that is NOT being used. This is announced over L2.
|
||||
endpoint_vip: ""
|
||||
# (Optional) Add additional SANs to the Kube API cert, this is useful
|
||||
# if you want to call the Kube API by hostname rather than IP
|
||||
tls_sans: []
|
||||
# (Optional) The DNS search domain to use for the nodes.
|
||||
# Default is "."
|
||||
# Use the default or leave empty to avoid possible DNS issues inside the cluster.
|
||||
bootstrap_search_domain: ""
|
||||
|
||||
#
|
||||
# (Optional) Flux details - Flux is used to manage the cluster configuration.
|
||||
#
|
||||
# (Required) The pod CIDR for the cluster, this must NOT overlap with any
|
||||
# existing networks and is usually a /16 (64K IPs).
|
||||
# If you want to use IPv6 check the advanced flags below
|
||||
bootstrap_pod_network: "10.69.0.0/16"
|
||||
|
||||
flux:
|
||||
# (Required) Disable to use a different tool (e.g. kubectl, Argo, Kluctl)
|
||||
# (Required) The service CIDR for the cluster, this must NOT overlap with any
|
||||
# existing networks and is usually a /16 (64K IPs).
|
||||
# If you want to use IPv6 check the advanced flags below
|
||||
bootstrap_service_network: "10.96.0.0/16"
|
||||
|
||||
# (Required) The IP address of the Kube API, choose an available IP in
|
||||
# your nodes host network that is NOT being used. This is announced over L2.
|
||||
# For k3s kube-vip is used, built-in functionality is used with Talos
|
||||
bootstrap_controllers_vip: ""
|
||||
|
||||
# (Optional) Add additional SANs to the Kube API cert, this is useful
|
||||
# if you want to call the Kube API by hostname rather than IP
|
||||
bootstrap_tls_sans: []
|
||||
|
||||
# (Required) Age Public Key (e.g. age1...)
|
||||
# 1. Generate a new key with the following command:
|
||||
# > task sops:age-keygen
|
||||
# 2. Copy the public key and paste it below
|
||||
bootstrap_sops_age_pubkey: ""
|
||||
|
||||
# (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments.
|
||||
# Needs a BGP capable router setup with the node IPs as peers.
|
||||
# See: https://docs.cilium.io/en/latest/network/bgp-control-plane/
|
||||
bootstrap_bgp:
|
||||
enabled: false
|
||||
# (Required) Age Public Key (e.g. age1...)
|
||||
# 1. Generate a new key with the following command:
|
||||
# > task sops:age-keygen
|
||||
# 2. Copy the public key and paste it below
|
||||
sops_age_public_key: ""
|
||||
# (Required) Options for GitHub
|
||||
github:
|
||||
# (Required) GitHub repository URL (for private repos use the ssh:// URL)
|
||||
address: ""
|
||||
# (Required) GitHub repository branch
|
||||
branch: main
|
||||
# (Required) Options for Flux GitHub webhook
|
||||
webhook:
|
||||
# (Required) Enable to setup GitHub push-based sync after cluster creation
|
||||
enabled: true
|
||||
# Token for GitHub push-based sync
|
||||
# 1. Generate a new token with the following command:
|
||||
# > openssl rand -hex 16
|
||||
# 2. Copy the token and paste it below
|
||||
token: ""
|
||||
# (Required) Private key for Flux to access the GitHub repository
|
||||
private:
|
||||
# (Required) Enable to use a private GitHub repository
|
||||
enabled: false
|
||||
# Private key for Flux to access the GitHub repository
|
||||
# 1. Generate a new key with the following command:
|
||||
# > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
|
||||
# 2. Make sure to paste public key from "github-deploy.key.pub" into
|
||||
# the deploy keys section of your repository settings.
|
||||
# 3. Uncomment and paste the private key below
|
||||
# key: |
|
||||
# -----BEGIN OPENSSH PRIVATE KEY-----
|
||||
# ...
|
||||
# -----END OPENSSH PRIVATE KEY-----
|
||||
# (Optional) If using multiple BGP peers add them here.
|
||||
# Default is .1 derrived from host_network: ['x.x.x.1']
|
||||
peers: []
|
||||
# (Required) Set the BGP Autonomous System Number for the router(s) and nodes.
|
||||
# If these match, iBGP will be used. If not, eBGP will be used.
|
||||
peer_asn: "" # Router(s) AS
|
||||
local_asn: "" # Node(s) AS
|
||||
# (Required) The advertised CIDR for the cluster, this must NOT overlap with any
|
||||
# existing networks and is usually a /16 (64K IPs).
|
||||
# If you want to use IPv6 check the advanced flags below
|
||||
advertised_network: ""
|
||||
|
||||
#
|
||||
# (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
|
||||
# 2. (Required) Flux details - Flux is used to manage the cluster configuration.
|
||||
#
|
||||
|
||||
cloudflare:
|
||||
# (Required) GitHub repository URL (for private repos use the ssh:// URL)
|
||||
bootstrap_github_address: ""
|
||||
|
||||
# (Required) GitHub repository branch
|
||||
bootstrap_github_branch: "main"
|
||||
|
||||
# (Required) Token for GitHub push-based sync
|
||||
# 1. Generate a new token with the following command:
|
||||
# > openssl rand -hex 16
|
||||
# 2. Copy the token and paste it below
|
||||
bootstrap_github_webhook_token: ""
|
||||
|
||||
# (Optional) Private key for Flux to access the GitHub repository
|
||||
# 1. Generate a new key with the following command:
|
||||
# > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
|
||||
# 2. Make sure to paste public key from "github-deploy.key.pub" into
|
||||
# the deploy keys section of your repository settings.
|
||||
# 3. Uncomment and paste the private key below
|
||||
# 4. Optionally set your repository on GitHub to private
|
||||
# bootstrap_github_private_key: |
|
||||
# -----BEGIN OPENSSH PRIVATE KEY-----
|
||||
# ...
|
||||
# -----END OPENSSH PRIVATE KEY-----
|
||||
|
||||
#
|
||||
# 3. (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
|
||||
#
|
||||
|
||||
bootstrap_cloudflare:
|
||||
# (Required) Disable to use a different DNS provider
|
||||
enabled: false
|
||||
# (Required) Cloudflare Domain
|
||||
@@ -209,11 +197,11 @@ cloudflare:
|
||||
ingress_vip: ""
|
||||
|
||||
# (Optional) Feature gates are used to enable experimental features
|
||||
feature_gates:
|
||||
# Enable Dual Stack IPv4 first
|
||||
# IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
|
||||
# Ref: https://github.com/onedr0p/cluster-template/issues/1148
|
||||
# Keep in mind that Cilium does not currently support IPv6 L2 announcements.
|
||||
# Make sure you set cluster.pod_cidr and cluster.service_cidr
|
||||
# to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
|
||||
dual_stack_ipv4_first: false
|
||||
# bootstrap_feature_gates:
|
||||
# # Enable Dual Stack IPv4 first
|
||||
# # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
|
||||
# # Ref: https://github.com/onedr0p/cluster-template/issues/1148
|
||||
# # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
|
||||
# # Make sure you set cluster.pod_cidr and cluster.service_cidr
|
||||
# # to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
|
||||
# dual_stack_ipv4_first: false
|
||||
Reference in new issue
Block a user