home-cluster/bootstrap/templates/kubernetes/talos/talconfig.yaml.j2

# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
---
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
talosVersion: v1.6.3
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
kubernetesVersion: v1.29.1

clusterName: &cluster home-kubernetes
endpoint: https://{{ cluster.endpoint_vip }}:6443
clusterPodNets:
  - "{{ cluster.pod_network.split(',')[0] }}"
clusterSvcNets:
  - "{{ cluster.service_network.split(',')[0] }}"
additionalApiServerCertSans: &sans
  - "{{ cluster.endpoint_vip }}"
  - 127.0.0.1 # KubePrism
  {% for item in cluster.tls_sans %}
  - "{{ item }}"
  {% endfor %}
additionalMachineCertSans: *sans
cniConfig:
  name: none

nodes:
  {% for item in nodes.inventory %}
  - hostname: "{{ item.name }}"
    ipAddress: "{{ item.address }}"
    {% if item.talos_disk_device.startswith('/') %}
    installDisk: "{{ item.talos_disk_device }}"
    {% else %}
    installDiskSelector:
      serial: "{{ item.talos_disk_device }}"
    {% endif %}
    controlPlane: {{ (item.controller) | string | lower }}
    networkInterfaces:
      - interface: eth0
        dhcp: false
        {% if distribution.talos.vlan %}
        vlans:
          - vlanId: {{ distribution.talos.vlan }}
            addresses:
              - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
            mtu: 1500
            routes:
              - network: 0.0.0.0/0
                gateway: "{{ nodes.host_network | nthhost(1) }}"
            {% if item.controller %}
            vip:
              ip: "{{ cluster.endpoint_vip }}"
            {% endif %}
        {% else %}
        addresses:
          - "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
        mtu: 1500
        routes:
          - network: 0.0.0.0/0
            gateway: "{{ nodes.host_network | nthhost(1) }}"
        {% if item.controller %}
        vip:
          ip: "{{ cluster.endpoint_vip }}"
        {% endif %}
        {% endif %}
  {% endfor %}

controlPlane:
{% if distribution.talos.schematics.enabled %}
  schematic:
    customization:
{{ distribution.talos.schematics.customization | indent(6, first=True) }}
{% endif %}
  patches:
    # Configure containerd
    - &containerdPatch |-
      machine:
        files:
          - op: create
            path: /etc/cri/conf.d/20-customization.part
            content: |-
              [plugins."io.containerd.grpc.v1.cri"]
                enable_unprivileged_ports = true
                enable_unprivileged_icmp = true
              [plugins."io.containerd.grpc.v1.cri".containerd]
                discard_unpacked_layers = false
              [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
                discard_unpacked_layers = false

    # Disable search domain everywhere
    - &disableSearchDomainPatch |-
      machine:
        network:
          disableSearchDomain: true

    # Enable cluster discovery
    - &discoveryPatch |-
      cluster:
        discovery:
          registries:
            kubernetes:
              disabled: false
            service:
              disabled: false

    # Configure kubelet
    - &kubeletPatch |-
      machine:
        kubelet:
          extraArgs:
            image-gc-low-threshold: 50
            image-gc-high-threshold: 55
            rotate-server-certificates: true
          nodeIP:
            validSubnets:
              - "{{ nodes.host_network }}"

    # Enable KubePrism
    - &kubePrismPatch |-
      machine:
        features:
          kubePrism:
            enabled: true
            port: 7445

    # Force nameserver
    - &nameserverPatch |-
      machine:
        network:
          nameservers:
            {% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
            - {{ item }}
            {% endfor %}

    # Configure NTP
    - &ntpPatch |-
      machine:
        time:
          disabled: false
          servers:
            - time.cloudflare.com

    # Custom sysctl settings
    - &sysctlPatch |-
      machine:
        sysctls:
          fs.inotify.max_queued_events: 65536
          fs.inotify.max_user_watches: 524288
          fs.inotify.max_user_instances: 8192

    # Cluster configuration
    - |-
      cluster:
        allowSchedulingOnMasters: true
        controllerManager:
          extraArgs:
            bind-address: 0.0.0.0
        proxy:
          disabled: true
        scheduler:
          extraArgs:
            bind-address: 0.0.0.0

    # ETCD configuration
    - |-
      cluster:
        etcd:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
          advertisedSubnets:
            - "{{ nodes.host_network }}"

    # Disable default API server admission plugins.
    - |-
      - op: remove
        path: /cluster/apiServer/admissionControl

    # Enable K8s Talos API Access
    - |-
      machine:
        features:
          kubernetesTalosAPIAccess:
            enabled: true
            allowedRoles:
              - os:operator
            allowedKubernetesNamespaces:
              - system-upgrade

{% if nodes.inventory | selectattr('controller', 'equalto', False) | list | length %}
worker:
{% if distribution.talos.schematics.enabled %}
  schematic:
    customization:
{{ distribution.talos.schematics.customization | indent(6, first=True) }}
{% endif %}
  patches:
    - *containerdPatch
    - *disableSearchDomainPatch
    - *discoveryPatch
    - *kubeletPatch
    - *kubePrismPatch
    - *nameserverPatch
    - *ntpPatch
    - *sysctlPatch
{% endif %}