--- # # (Required) Distribution represents the Kubernetes distribution layer and any additional customizations # distribution: # (Required) Distribution can either be k3s, or talos type: k3s # (Optional) Talos Specific Options talos: {} # # (Required) If you need any additional System Extensions and/or kernel arguments generate a schematic ID. # # Go to https://factory.talos.dev/ and choose the System Extensions you need and/or add extra kernel arguments. # # Otherwise use below default. # schematicID: "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba" # # (Optional) Add vlan tag to network master device # # See: https://www.talos.dev/latest/advanced/advanced-networking/#vlans # vlan: 1 # # (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments. # # Needs a BGP capable router setup with the node IPs as peers. # # See: https://docs.cilium.io/en/latest/network/bgp-control-plane/ # bgp: # enabled: true # # (Optional) If using multiple BGP peers add them here. # # Default is .1 derrived from host_network: ['x.x.x.1'] # peers: [] # # (Required) Set the BGP Autonomous System Number for the router(s) and nodes. # # If these match, iBGP will be used. If not, eBGP will be used. # peer_asn: 64512 # Router(s) AS # local_asn: 64512 # Node(s) AS # # (Required) The loadbalancer CIDR for the cluster, this must NOT overlap with any # # existing networks and is usually a /16 (64K IPs). # # If you want to use IPv6 check the advanced flags below # loadbalancer_network: 10.123.0.0/16 # # (Required) Timezone is your IANA formatted timezone (e.g. America/New_York) # timezone: "" # # (Required) Nodes represents the physical or virtual machines layer and any additional customizations # nodes: # (Required) CIDR your nodes are on (e.g. 192.168.1.0/24) host_network: "" # (Optional) The DNS server to use for the cluster, this can be an existing # local DNS server or a public one. # Default is ["1.1.1.1", "1.0.0.1"] # If using a local DNS server make sure it meets the following requirements: # 1. your nodes can reach it # 2. it is configured to forward requests to a public DNS server # 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01 # If using multiple DNS servers make sure they are setup the same way, there is no # guarantee that the first DNS server will always be used for every lookup. dns_servers: [] # (Optional) The DNS search domain to use for the nodes. # Default is "." # Use the default or leave empty to avoid possible DNS issues inside the cluster. search_domain: "" # (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3 # Worker nodes are optional inventory: [] # - name: "" # Name of the node (must match [a-z0-9-\.]+) # address: "" # IP address of the node # controller: true # (Required) Set to true if this is a controller node # ssh_username: "" # (Required: k3s) SSH username of the node # talos_disk_device: "" # (Required: Talos) Device path or serial number of the disk for this node # ... # # (Required) Cluster represents the Kubernetes cluster layer and any additional customizations # cluster: # (Required) The pod CIDR for the cluster, this must NOT overlap with any # existing networks and is usually a /16 (64K IPs). # If you want to use IPv6 check the advanced flags below pod_network: 10.69.0.0/16 # (Required) The service CIDR for the cluster, this must NOT overlap with any # existing networks and is usually a /16 (64K IPs). # If you want to use IPv6 check the advanced flags below service_network: 10.96.0.0/16 # (Required) The IP address of the Kube API, choose an available IP in # your nodes host network that is NOT being used. This is announced over L2. endpoint_vip: "" # (Optional) Add additional SANs to the Kube API cert, this is useful # if you want to call the Kube API by hostname rather than IP tls_sans: [] # # (Optional) Flux details - Flux is used to manage the cluster configuration. # flux: # (Required) Disable to use a different tool (e.g. kubectl, Argo, Kluctl) enabled: false # (Required) Age Public Key (e.g. age1...) # 1. Generate a new key with the following command: # > task sops:age-keygen # 2. Copy the public key and paste it below sops_age_public_key: "" # (Required) Options for GitHub github: # (Required) GitHub repository URL (for private repos use the ssh:// URL) address: "" # (Required) GitHub repository branch branch: main # (Required) Options for Flux GitHub webhook webhook: # (Required) Enable to setup GitHub push-based sync after cluster creation enabled: true # Token for GitHub push-based sync # 1. Generate a new token with the following command: # > openssl rand -hex 16 # 2. Copy the token and paste it below token: "" # (Required) Private key for Flux to access the GitHub repository private: # (Required) Enable to use a private GitHub repository enabled: false # Private key for Flux to access the GitHub repository # 1. Generate a new key with the following command: # > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P "" # 2. Make sure to paste public key from "github-deploy.key.pub" into # the deploy keys section of your repository settings. # 3. Uncomment and paste the private key below # key: | # -----BEGIN OPENSSH PRIVATE KEY----- # ... # -----END OPENSSH PRIVATE KEY----- # # (Optional) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling. # cloudflare: # (Required) Disable to use a different DNS provider enabled: false # (Required) Cloudflare Domain domain: "" # (Required) Cloudflare API Token (NOT API Key) # 1. Head over to Cloudflare and create a API Token by going to # https://dash.cloudflare.com/profile/api-tokens # 2. Under the `API Tokens` section click the blue `Create Token` button. # 3. Click the blue `Use template` button for the `Edit zone DNS` template. # 4. Name your token something like `home-kubernetes` # 5. Under `Permissions`, click `+ Add More` and add each permission below: # `Zone - DNS - Edit` # `Account - Cloudflare Tunnel - Read` # 6. Limit the permissions to a specific account and zone resources. # 7. Click the blue `Continue to Summary` button and then the blue `Create Token` button. # 8. Copy the token and paste it below. token: "" # (Required) Optionals for Cloudflare Acme acme: # (Required) Any email you want to be associated with the ACME account (used for TLS certs via letsencrypt.org) email: "" # (Required) Use the ACME production server when requesting the wildcard certificate. # By default the ACME staging server is used. This is to prevent being rate-limited. # Update this option to `true` when you have verified the staging certificate # works and then re-run `task configure` and push your changes to Github. production: false # (Required) Provide LAN access to the cluster ingresses for internal ingress classes # The Load balancer IP for internal ingress, choose an available IP # in your nodes host network that is NOT being used. This is announced over L2. ingress_vip: "" # (Required) Gateway is used for providing DNS to your cluster on LAN # The Load balancer IP for k8s_gateway, choose an available IP # in your nodes host network that is NOT being used. This is announced over L2. gateway_vip: "" # (Required) Options for Cloudflare Tunnel # 1. Authenticate cloudflared to your domain # > cloudflared tunnel login # 2. Create the tunnel # > cloudflared tunnel create k8s # 3. Copy the AccountTag, TunnelID, and TunnelSecret from the tunnel configuration file and paste them below tunnel: # (Required) Cloudflare Account ID (cat ~/.cloudflared/*.json | jq -r .AccountTag) account_id: "" # (Required) Cloudflared Tunnel ID (cat ~/.cloudflared/*.json | jq -r .TunnelID) id: "" # (Required) Cloudflared Tunnel Secret (cat ~/.cloudflared/*.json | jq -r .TunnelSecret) secret: "" # (Required) Provide WAN access to the cluster ingresses for external ingress classes # The Load balancer IP for external ingress, choose an available IP # in your nodes host network that is NOT being used. This is announced over L2. ingress_vip: "" # (Optional) Feature gates are used to enable experimental features feature_gates: # Enable Dual Stack IPv4 first # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it. # Ref: https://github.com/onedr0p/cluster-template/issues/1148 # Keep in mind that Cilium does not currently support IPv6 L2 announcements. # Make sure you set cluster.pod_cidr and cluster.service_cidr # to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64" dual_stack_ipv4_first: false