Wasurerarenai
025f5ddedf
* feat(talos): Allow users to include talhelper patches * feat(talos): Add user talhelper patches to example config * fix: Missing talos user_patches check on workers block
247 lines
6.5 KiB
YAML
247 lines
6.5 KiB
YAML
# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
|
|
---
|
|
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
|
|
talosVersion: v1.6.4
|
|
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
|
|
kubernetesVersion: v1.29.1
|
|
|
|
clusterName: &cluster home-kubernetes
|
|
endpoint: https://{{ cluster.endpoint_vip }}:6443
|
|
clusterPodNets:
|
|
- "{{ cluster.pod_network.split(',')[0] }}"
|
|
clusterSvcNets:
|
|
- "{{ cluster.service_network.split(',')[0] }}"
|
|
additionalApiServerCertSans: &sans
|
|
- "{{ cluster.endpoint_vip }}"
|
|
- 127.0.0.1 # KubePrism
|
|
{% for item in cluster.tls_sans %}
|
|
- "{{ item }}"
|
|
{% endfor %}
|
|
additionalMachineCertSans: *sans
|
|
cniConfig:
|
|
name: none
|
|
|
|
nodes:
|
|
{% for item in nodes.inventory %}
|
|
- hostname: "{{ item.name }}"
|
|
ipAddress: "{{ item.address }}"
|
|
{% if item.talos_disk_device.startswith('/') %}
|
|
installDisk: "{{ item.talos_disk_device }}"
|
|
{% else %}
|
|
installDiskSelector:
|
|
serial: "{{ item.talos_disk_device }}"
|
|
{% endif %}
|
|
{% if distribution.talos.secureboot.enabled %}
|
|
machineSpec:
|
|
secureboot: true
|
|
talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }}
|
|
{% else %}
|
|
talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }}
|
|
{% endif %}
|
|
controlPlane: {{ (item.controller) | string | lower }}
|
|
networkInterfaces:
|
|
- interface: eth0
|
|
dhcp: false
|
|
{% if distribution.talos.vlan %}
|
|
vlans:
|
|
- vlanId: {{ distribution.talos.vlan }}
|
|
addresses:
|
|
- "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
|
|
mtu: 1500
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
{% if nodes.default_gateway %}
|
|
gateway: "{{ nodes.default_gateway }}"
|
|
{% else %}
|
|
gateway: "{{ nodes.host_network | nthhost(1) }}"
|
|
{% endif %}
|
|
{% if item.controller %}
|
|
vip:
|
|
ip: "{{ cluster.endpoint_vip }}"
|
|
{% endif %}
|
|
{% else %}
|
|
addresses:
|
|
- "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
|
|
mtu: 1500
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
{% if nodes.default_gateway %}
|
|
gateway: "{{ nodes.default_gateway }}"
|
|
{% else %}
|
|
gateway: "{{ nodes.host_network | nthhost(1) }}"
|
|
{% endif %}
|
|
{% if item.controller %}
|
|
vip:
|
|
ip: "{{ cluster.endpoint_vip }}"
|
|
{% endif %}
|
|
{% endif %}
|
|
{% if distribution.talos.user_patches %}
|
|
patches:
|
|
- "@./patches/node_{{ item.name }}.yaml"
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
patches:
|
|
# Configure containerd
|
|
- |-
|
|
machine:
|
|
files:
|
|
- op: create
|
|
path: /etc/cri/conf.d/20-customization.part
|
|
content: |-
|
|
[plugins."io.containerd.grpc.v1.cri"]
|
|
enable_unprivileged_ports = true
|
|
enable_unprivileged_icmp = true
|
|
[plugins."io.containerd.grpc.v1.cri".containerd]
|
|
discard_unpacked_layers = false
|
|
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
|
|
discard_unpacked_layers = false
|
|
|
|
# Disable search domain everywhere
|
|
- |-
|
|
machine:
|
|
network:
|
|
disableSearchDomain: true
|
|
|
|
# Enable cluster discovery
|
|
- |-
|
|
cluster:
|
|
discovery:
|
|
registries:
|
|
kubernetes:
|
|
disabled: false
|
|
service:
|
|
disabled: false
|
|
|
|
# Configure kubelet
|
|
- |-
|
|
machine:
|
|
kubelet:
|
|
extraArgs:
|
|
image-gc-low-threshold: 50
|
|
image-gc-high-threshold: 55
|
|
rotate-server-certificates: true
|
|
nodeIP:
|
|
validSubnets:
|
|
- "{{ nodes.host_network }}"
|
|
|
|
# Force nameserver
|
|
- |-
|
|
machine:
|
|
network:
|
|
nameservers:
|
|
{% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
|
|
- {{ item }}
|
|
{% endfor %}
|
|
|
|
# Configure NTP
|
|
- |-
|
|
machine:
|
|
time:
|
|
disabled: false
|
|
servers:
|
|
- time.cloudflare.com
|
|
|
|
# Custom sysctl settings
|
|
- |-
|
|
machine:
|
|
sysctls:
|
|
fs.inotify.max_queued_events: 65536
|
|
fs.inotify.max_user_watches: 524288
|
|
fs.inotify.max_user_instances: 8192
|
|
|
|
# Mount openebs-hostpath in kubelet
|
|
- |-
|
|
machine:
|
|
kubelet:
|
|
extraMounts:
|
|
- destination: /var/openebs/local
|
|
type: bind
|
|
source: /var/openebs/local
|
|
options:
|
|
- bind
|
|
- rshared
|
|
- rw
|
|
|
|
# Disable predictable NIC naming
|
|
- |-
|
|
machine:
|
|
install:
|
|
extraKernelArgs:
|
|
- net.ifnames=0
|
|
|
|
{% if distribution.talos.secureboot.enabled and
|
|
distribution.talos.secureboot.encrypt_disk_with_tpm %}
|
|
# Encrypt system disk with TPM
|
|
- |-
|
|
machine:
|
|
systemDiskEncryption:
|
|
ephemeral:
|
|
provider: luks2
|
|
keys:
|
|
- slot: 0
|
|
tpm: {}
|
|
state:
|
|
provider: luks2
|
|
keys:
|
|
- slot: 0
|
|
tpm: {}
|
|
{% endif %}
|
|
{% if distribution.talos.user_patches %}
|
|
# User specified global patches
|
|
- "@./patches/global.yaml"
|
|
{% endif %}
|
|
|
|
controlPlane:
|
|
patches:
|
|
# Cluster configuration
|
|
- |-
|
|
cluster:
|
|
allowSchedulingOnMasters: true
|
|
controllerManager:
|
|
extraArgs:
|
|
bind-address: 0.0.0.0
|
|
proxy:
|
|
disabled: true
|
|
scheduler:
|
|
extraArgs:
|
|
bind-address: 0.0.0.0
|
|
|
|
# ETCD configuration
|
|
- |-
|
|
cluster:
|
|
etcd:
|
|
extraArgs:
|
|
listen-metrics-urls: http://0.0.0.0:2381
|
|
advertisedSubnets:
|
|
- "{{ nodes.host_network }}"
|
|
|
|
# Disable default API server admission plugins.
|
|
- |-
|
|
- op: remove
|
|
path: /cluster/apiServer/admissionControl
|
|
|
|
# Enable K8s Talos API Access
|
|
- |-
|
|
machine:
|
|
features:
|
|
kubernetesTalosAPIAccess:
|
|
enabled: true
|
|
allowedRoles:
|
|
- os:admin
|
|
allowedKubernetesNamespaces:
|
|
- system-upgrade
|
|
|
|
{% if distribution.talos.user_patches %}
|
|
# User specified controlPlane patches
|
|
- "@./patches/controlPlane.yaml"
|
|
{% endif %}
|
|
|
|
{% if ( (distribution.talos.user_patches) and
|
|
(nodes.inventory | selectattr('controller', 'equalto', False) | list | length) ) %}
|
|
worker:
|
|
patches:
|
|
# User specified worker patches
|
|
- "@./patches/worker.yaml"
|
|
{% endif %}
|