From e5a7ba8da895d733c27d477d7e00c30be40e5da2 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Tue, 29 Oct 2024 10:10:31 -0400 Subject: [PATCH] feat(bootstrap): static ips and default ntp/dns servers (#1618) --- .../cilium/app/helm-values.yaml.j2 | 4 +-- .../cilium/config/cilium-l3.yaml.j2 | 2 +- .../talos/patches/global/dns.yaml.j2 | 6 ++++ .../talos/patches/global/ntp.yaml.j2 | 7 ++++ .../bootstrap/talos/talconfig.yaml.j2 | 33 +++---------------- .../kubernetes/flux/config/cluster.yaml.j2 | 2 +- config.sample.yaml | 25 +++++++------- 7 files changed, 32 insertions(+), 47 deletions(-) create mode 100644 bootstrap/templates/kubernetes/bootstrap/talos/patches/global/dns.yaml.j2 create mode 100644 bootstrap/templates/kubernetes/bootstrap/talos/patches/global/ntp.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2 index 74594022..3de4cea3 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2 @@ -12,7 +12,7 @@ cgroup: hostRoot: /sys/fs/cgroup cluster: id: 1 - name: "#{ bootstrap_cluster_name|default('home-kubernetes', true) }#" + name: "#{ bootstrap_cluster_name | default('home-kubernetes', true) }#" cni: exclusive: false # NOTE: devices might need to be set if you have more than one active NIC on your hosts @@ -43,7 +43,7 @@ l2announcements: #% endif %# loadBalancer: algorithm: maglev - mode: "#{ bootstrap_loadbalancer_mode|default('dsr', true) }#" + mode: "#{ bootstrap_loadbalancer_mode | default('dsr', true) }#" localRedirectPolicy: true operator: replicas: 1 diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/config/cilium-l3.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/config/cilium-l3.yaml.j2 index 80427a1b..e2a97148 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/config/cilium-l3.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/config/cilium-l3.yaml.j2 @@ -16,7 +16,7 @@ spec: #% for item in bootstrap_bgp.peers %# - peerAddress: "#{ item }#/32" peerASN: #{ bootstrap_bgp.peer_asn }# - peerPort: #{ bootstrap_bgp.peer_port | default(179) }# + peerPort: #{ bootstrap_bgp.peer_port | default(179, true) }# #% endfor %# #% else %# #% if bootstrap_node_default_gateway %# diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/dns.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/dns.yaml.j2 new file mode 100644 index 00000000..707a03ee --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/dns.yaml.j2 @@ -0,0 +1,6 @@ +machine: + network: + nameservers: + #% for item in bootstrap_dns_servers | default(["1.1.1.1","1.0.0.1"], true) %# + - #{ item }# + #% endfor %# diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/ntp.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/ntp.yaml.j2 new file mode 100644 index 00000000..3b3fad13 --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/ntp.yaml.j2 @@ -0,0 +1,7 @@ +machine: + time: + disabled: false + servers: + #% for item in bootstrap_ntp_servers | default(["time.cloudflare.com"], true) %# + - #{ item }# + #% endfor %# diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 index 34ccae6b..f0d9425d 100644 --- a/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 +++ b/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2 @@ -36,9 +36,9 @@ nodes: #% if bootstrap_secureboot.enabled %# machineSpec: secureboot: true - talosImageURL: factory.talos.dev/installer-secureboot/#{ item.schematic_id | default(bootstrap_schematic_id) }# + talosImageURL: factory.talos.dev/installer-secureboot/#{ item.schematic_id | default(bootstrap_schematic_id, true) }# #% else %# - talosImageURL: factory.talos.dev/installer/#{ item.schematic_id | default(bootstrap_schematic_id) }# + talosImageURL: factory.talos.dev/installer/#{ item.schematic_id | default(bootstrap_schematic_id, true) }# #% endif %# controlPlane: #{ (item.controller) | string | lower }# networkInterfaces: @@ -49,7 +49,7 @@ nodes: - vlanId: #{ bootstrap_vlan }# addresses: - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#" - mtu: #{ item.mtu | default(1500) }# + mtu: #{ item.mtu | default(1500, true) }# routes: - network: 0.0.0.0/0 #% if bootstrap_node_default_gateway %# @@ -62,7 +62,6 @@ nodes: ip: "#{ bootstrap_controller_vip }#" #% endif %# #% else %# - #% if item.address %# dhcp: false addresses: - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#" @@ -73,10 +72,7 @@ nodes: #% else %# gateway: "#{ bootstrap_node_network | nthhost(1) }#" #% endif %# - #% else %# - dhcp: true - #% endif %# - mtu: #{ item.mtu | default(1500) }# + mtu: #{ item.mtu | default(1500, true) }# #% if item.controller %# vip: ip: "#{ bootstrap_controller_vip }#" @@ -116,27 +112,6 @@ nodes: # Global patches patches: - #% if bootstrap_dns_servers | length %# - - # Force nameserver - |- - machine: - network: - nameservers: - #% for item in bootstrap_dns_servers %# - - #{ item }# - #% endfor %# - #% endif %# - #% if bootstrap_ntp_servers | length %# - - # Configure NTP - |- - machine: - time: - disabled: false - servers: - #% for item in bootstrap_ntp_servers %# - - #{ item }# - #% endfor %# - #% endif %# #% if bootstrap_secureboot.enabled and bootstrap_secureboot.encrypt_disk_with_tpm %# - # Encrypt system disk with TPM |- diff --git a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 index bae21e83..5c385b7b 100644 --- a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 @@ -12,7 +12,7 @@ spec: name: github-deploy-key #% endif %# ref: - branch: "#{ bootstrap_github_branch|default('main', true) }#" + branch: "#{ bootstrap_github_branch | default('main', true) }#" ignore: | # exclude all /* diff --git a/config.sample.yaml b/config.sample.yaml index 05ef430a..a7beb908 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -5,7 +5,7 @@ # # (Optional) Cluster name; affects Cilium and Talos -# Default is "home-kubernetes" +# DEFAULT: "home-kubernetes" bootstrap_cluster_name: "" # (Required) Generated schematic id from https://factory.talos.dev/ @@ -18,12 +18,12 @@ bootstrap_node_network: "" # Worker nodes are optional bootstrap_node_inventory: [] # - name: "" # (Required) Name of the node (must match [a-z0-9-\]+) - # address: "" # (Optional) IP address of the node (Remove if node has a static DHCP reservation) + # address: "" # (Optional) IP address of the node # controller: true # (Required) Set to true if this is a controller node # disk: "" # (Required) Device path or serial number of the disk for this node (talosctl disks -n --insecure) # mac_addr: "" # (Required) MAC address of the NIC for this node (talosctl get links -n --insecure) # schematic_id: "" # (Optional) Override the 'bootstrap_schematic_id' with a node specific schematic ID from https://factory.talos.dev/ - # mtu: "" # (Optional) MTU for the NIC, default is 1500 + # mtu: "" # (Optional) MTU for the NIC. DEFAULT: 1500 # manifests: # (Optional) Additional manifests to include after MachineConfig # - extra.yaml # Ref: https://www.talos.dev/v1.7/reference/configuration/extensions/extensionserviceconfig/ # extension_services: # (Optional) Additional talhelper ExtensionServices (supports talenv.sops.yaml envsubst) @@ -36,18 +36,15 @@ bootstrap_node_inventory: [] # - key=value # ... -# (Optional) The DNS servers to use for the cluster nodes. -# Default is pulled from your DHCP server. +# The DNS servers to use for the cluster nodes. +# DEFAULT: [1.1.1.1, 1.0.0.1] # If using a local DNS server make sure it meets the following requirements: # 1. your nodes can reach it # 2. it is configured to forward requests to a public DNS server -# 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01 -# If using multiple DNS servers make sure they are setup the same way, there is no -# guarantee that the first DNS server will always be used for every lookup. bootstrap_dns_servers: [] -# (Optional) The NTP servers to use for the cluster nodes. -# Default is pulled from your DHCP server. +# The NTP servers to use for the cluster nodes. +# DEFAULT: [time.cloudflare.com] bootstrap_ntp_servers: [] # (Required) The pod CIDR for the cluster, this must NOT overlap with any @@ -71,7 +68,7 @@ bootstrap_controller_vip: "" bootstrap_tls_sans: [] # (Optional) The default gateway for the nodes -# Default is derrived from bootstrap_node_network (e.g. 192.168.1.1) +# DEFAULT: .1 derrived from bootstrap_node_network (e.g. 192.168.1.1) bootstrap_node_default_gateway: "" # (Optional) Add vlan tag to network master device, leave blank if you tag ports on your switch instead @@ -90,13 +87,13 @@ bootstrap_age_pubkey: "" bootstrap_bgp: enabled: false # (Optional) If using multiple BGP peers add them here. - # Default is .1 derrived from host_network: ['x.x.x.1'] + # DEFAULT: .1 derrived from host_network: ['x.x.x.1'] peers: [] # (Required) Set the BGP Autonomous System Number for the router(s) and nodes. # If these match, iBGP will be used. If not, eBGP will be used. peer_asn: "" # Router(s) AS local_asn: "" # Node(s) AS - peer_port: 179 # BGP Port - default is TCP port 179 + peer_port: 179 # BGP Port. DEFAULT: 179 # (Required) The advertised CIDR for the cluster, this must NOT overlap with any # existing networks and is usually a /16 (64K IPs). # If you want to use IPv6 check the advanced flags below @@ -112,7 +109,7 @@ bootstrap_secureboot: encrypt_disk_with_tpm: false # (Optional) Change Cilium load balancer mode -# Default is "dsr" (Direct Server Return) +# DEFAULT: "dsr" # Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/ bootstrap_loadbalancer_mode: ""