home-cluster/bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2

# yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
---
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
talosVersion: v1.7.2
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
kubernetesVersion: v1.30.1

clusterName: "#{ bootstrap_cluster_name | default('home-kubernetes', true) }#"
endpoint: https://#{ bootstrap_controller_vip }#:6443
clusterPodNets:
  - "#{ bootstrap_pod_network.split(',')[0] }#"
clusterSvcNets:
  - "#{ bootstrap_service_network.split(',')[0] }#"
additionalApiServerCertSans: &sans
  - "#{ bootstrap_controller_vip }#"
  - 127.0.0.1 # KubePrism
  #% for item in bootstrap_tls_sans %#
  - "#{ item }#"
  #% endfor %#
additionalMachineCertSans: *sans

# Disable built-in Flannel to use Cilium
cniConfig:
  name: none

nodes:
  #% for item in bootstrap_node_inventory %#
  - hostname: "#{ item.name }#"
    ipAddress: "#{ item.address }#"
    #% if item.disk.startswith('/') %#
    installDisk: "#{ item.disk }#"
    #% else %#
    installDiskSelector:
      serial: "#{ item.disk }#"
    #% endif %#
    #% if bootstrap_secureboot.enabled %#
    machineSpec:
      secureboot: true
    talosImageURL: factory.talos.dev/installer-secureboot/#{ item.schematic_id | default(bootstrap_talos.schematic_id) }#
    #% else %#
    talosImageURL: factory.talos.dev/installer/#{ item.schematic_id | default(bootstrap_talos.schematic_id) }#
    #% endif %#
    controlPlane: #{ (item.controller) | string | lower }#
    networkInterfaces:
      - deviceSelector:
          hardwareAddr: "#{ item.mac_addr | lower }#"
        #% if bootstrap_vlan %#
        vlans:
          - vlanId: #{ bootstrap_vlan }#
            addresses:
              - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
            mtu: #{ item.mtu | default(1500) }#
            routes:
              - network: 0.0.0.0/0
                #% if bootstrap_node_default_gateway %#
                gateway: "#{ bootstrap_node_default_gateway }#"
                #% else %#
                gateway: "#{ bootstrap_node_network | nthhost(1) }#"
                #% endif %#
            #% if item.controller %#
            vip:
              ip: "#{ bootstrap_controller_vip }#"
            #% endif %#
        #% else %#
        #% if item.address %#
        dhcp: false
        addresses:
          - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
        routes:
          - network: 0.0.0.0/0
            #% if bootstrap_node_default_gateway %#
            gateway: "#{ bootstrap_node_default_gateway }#"
            #% else %#
            gateway: "#{ bootstrap_node_network | nthhost(1) }#"
            #% endif %#
        #% else %#
        dhcp: true
        #% endif %#
        mtu: #{ item.mtu | default(1500) }#
        #% if item.controller %#
        vip:
          ip: "#{ bootstrap_controller_vip }#"
        #% endif %#
        #% endif %#
    #% if bootstrap_user_patches %#
    patches:
      - "@./patches/node_#{ item.name }#.yaml"
    #% endif %#
  #% endfor %#

patches:
  # Configure containerd
  - |-
    machine:
      files:
        - op: create
          path: /etc/cri/conf.d/20-customization.part
          content: |-
            [plugins."io.containerd.grpc.v1.cri"]
              enable_unprivileged_ports = true
              enable_unprivileged_icmp = true
            [plugins."io.containerd.grpc.v1.cri".containerd]
              discard_unpacked_layers = false
            [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
              discard_unpacked_layers = false

  # Disable search domain everywhere
  - |-
    machine:
      network:
        disableSearchDomain: true

  # Enable cluster discovery
  - |-
    cluster:
      discovery:
        registries:
          kubernetes:
            disabled: false
          service:
            disabled: false

  # Configure kubelet
  - |-
    machine:
      kubelet:
        extraArgs:
          rotate-server-certificates: true
        nodeIP:
          validSubnets:
            - #{ bootstrap_node_network }#

  #% if bootstrap_dns_servers | length %#
  # Force nameserver
  - |-
    machine:
      network:
        nameservers:
          #% for item in bootstrap_dns_servers %#
          - #{ item }#
          #% endfor %#
  #% endif %#

  #% if bootstrap_ntp_servers | length %#
  # Configure NTP
  - |-
    machine:
      time:
        disabled: false
        servers:
          #% for item in bootstrap_ntp_servers %#
          - #{ item }#
          #% endfor %#
  #% endif %#

  # Custom sysctl settings
  - |-
    machine:
      sysctls:
        fs.inotify.max_queued_events: "65536"
        fs.inotify.max_user_watches: "524288"
        fs.inotify.max_user_instances: "8192"
        net.core.rmem_max: "2500000"
        net.core.wmem_max: "2500000"

  # Mount openebs-hostpath in kubelet
  - |-
    machine:
      kubelet:
        extraMounts:
          - destination: /var/openebs/local
            type: bind
            source: /var/openebs/local
            options:
              - bind
              - rshared
              - rw

  #% if bootstrap_secureboot.enabled and bootstrap_secureboot.encrypt_disk_with_tpm %#
  # Encrypt system disk with TPM
  - |-
    machine:
      systemDiskEncryption:
        ephemeral:
          provider: luks2
          keys:
            - slot: 0
              tpm: {}
        state:
          provider: luks2
          keys:
            - slot: 0
              tpm: {}
  #% endif %#

  #% if bootstrap_user_patches %#
  # User specified global patches
  - "@./patches/global.yaml"
  #% endif %#

controlPlane:
  patches:
    # Cluster configuration
    - |-
      cluster:
        allowSchedulingOnControlPlanes: true
        controllerManager:
          extraArgs:
            bind-address: 0.0.0.0
        coreDNS:
          disabled: true
        proxy:
          disabled: true
        scheduler:
          extraArgs:
            bind-address: 0.0.0.0

    # ETCD configuration
    - |-
      cluster:
        etcd:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
          advertisedSubnets:
            - #{ bootstrap_node_network }#

    # Disable default API server admission plugins.
    - |-
      - op: remove
        path: /cluster/apiServer/admissionControl

    # Enable K8s Talos API Access
    - |-
      machine:
        features:
          kubernetesTalosAPIAccess:
            enabled: true
            allowedRoles:
              - os:admin
            allowedKubernetesNamespaces:
              - system-upgrade
    #% if bootstrap_user_patches %#
    # User specified controlPlane patches
    - "@./patches/controlPlane.yaml"
    #% endif %#
#% if ((bootstrap_user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
worker:
  patches:
    # User specified worker patches
    - "@./patches/worker.yaml"
#% endif %#