update and remove dns from tf

ansible/group_vars/all/all.yml

@@ -38,6 +38,9 @@ managed_users:
 base:
   ntp:
     server: 0.us.pool.ntp.org
+  monitoring:
+    cert_dir: /var/lib/icinga2/certs
+    server: monitor.vntx.net
 
 # SSH service name (varies by distribution)
 ssh_service: "{{ 'ssh' if ansible_os_family == 'Debian' else 'sshd' }}"

ansible/group_vars/bind9_servers/mcintire.me.yml

@@ -14,7 +14,7 @@ mcintire_me_zone:
       preference: 20
   hosts:
     - name: mail
-      ip: 204.110.191.5
+      ip: 107.174.178.20
     - name: photos
       ip: 204.110.191.8
   other_name_servers:
@@ -23,7 +23,7 @@ mcintire_me_zone:
     - _autodiscover._tcp.mcintire.me. IN SRV 0 0 443 mail.w5isp.com.
   text:
     - name: '@'
-      text: '"v=spf1 mx a ip4:204.110.191.5 ~all"'
+      text: '"v=spf1 mx a ip4:107.174.178.20 ~all"'
     - name: _dmarc
       text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"'
     - name: dkim._domainkey

ansible/group_vars/bind9_servers/reverse_191.yml

@@ -1,7 +1,6 @@
 ---
 # 191.110.204.in-addr.arpa reverse DNS zone
 # Mapping 204.110.191.0-255 -> *.191.client.vntx.net
-# Exception: 204.110.191.5 -> mail.mcintire.me
 reverse_191_zone:
   name: 191.110.204.in-addr.arpa
   type: master
@@ -15,7 +14,7 @@ reverse_191_zone:
   - 2.191.110.204.in-addr.arpa. IN PTR 2.191.client.vntx.net.
   - 3.191.110.204.in-addr.arpa. IN PTR 3.191.client.vntx.net.
   - 4.191.110.204.in-addr.arpa. IN PTR 4.191.client.vntx.net.
-  - 5.191.110.204.in-addr.arpa. IN PTR mail.mcintire.me.
+  - 5.191.110.204.in-addr.arpa. IN PTR 5.191.client.vntx.net.
   - 6.191.110.204.in-addr.arpa. IN PTR 6.191.client.vntx.net.
   - 7.191.110.204.in-addr.arpa. IN PTR 7.191.client.vntx.net.
   - 8.191.110.204.in-addr.arpa. IN PTR 8.191.client.vntx.net.

ansible/group_vars/bind9_servers/towerops.net.yml

@@ -7,13 +7,31 @@ towerops_net_zone:
   name_servers:
     - ns1.as393837.net.
     - ns-global.kjsl.com.
+  mail_servers:
+    - name: mail.mcintire.me.
+      preference: 10
+    - name: mail.nsnw.ca.
+      preference: 20
   hosts:
     - name: '@'
       ip: 204.110.191.195
   other_name_servers:
+    - autodiscover.towerops.net. IN CNAME mail.mcintire.me.
+    - autoconfig.towerops.net. IN CNAME mail.mcintire.me.
+    - _autodiscover._tcp.towerops.net. IN SRV 0 0 443 mail.mcintire.me.
+    - 4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey.towerops.net. IN CNAME 4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com.
+    - l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey.towerops.net. IN CNAME l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com.
+    - 2skkb53ep3vfbkdstfmm2elfthurggid._domainkey.towerops.net. IN CNAME 2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com.
+    - mail.towerops.net. IN MX 10 feedback-smtp.us-east-1.amazonses.com.
     - em6505.towerops.net. IN CNAME u177982.wl233.sendgrid.net.
     - s1._domainkey.towerops.net. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net.
     - s2._domainkey.towerops.net. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net.
   text:
+    - name: '@'
+      text: '"v=spf1 mx a ip4:204.110.191.5 ~all"'
+    - name: mail
+      text: '"v=spf1 include:amazonses.com ~all"'
     - name: _dmarc
       text: '"v=DMARC1; p=none;"'
+    - name: dkim._domainkey
+      text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"'

ansible/host_vars/dokku.w5isp.com.yml

@@ -0,0 +1,6 @@
+---
+ansible_user: ansible
+ansible_host: 204.110.191.218
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/ansible
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

ansible/host_vars/monitor.vntx.net.yml

@@ -0,0 +1,6 @@
+---
+ansible_user: graham
+ansible_host: 204.110.191.241
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/id_ed25519
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

ansible/host_vars/netbox.vntx.net.yml

@@ -1,8 +1,12 @@
 ---
 # Host-specific configuration for netbox.vntx.net
 
-# Python interpreter
+# Ansible connection settings
+ansible_user: graham
+ansible_host: 204.110.191.243
 ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/id_ed25519
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
 
 # Override defaults for NetBox installation
 netbox_port: 8001

ansible/host_vars/radius.vntx.net.yml

@@ -0,0 +1,6 @@
+---
+ansible_user: graham
+ansible_host: 204.110.191.248
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/id_ed25519
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

ansible/host_vars/skippy.w5isp.com.yml

@@ -0,0 +1,6 @@
+---
+ansible_user: ansible
+ansible_host: 204.110.191.8
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/ansible
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

ansible/host_vars/unimus.vntx.net.yml

@@ -0,0 +1,6 @@
+---
+ansible_user: ansible
+ansible_host: 204.110.191.238
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/ansible
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

ansible/host_vars/vpn.vntx.net.yml

@@ -0,0 +1,6 @@
+---
+ansible_user: ansible
+ansible_host: 204.110.191.247
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_private_key_file: /Users/graham/.ssh/ansible
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

ansible/hosts

@@ -2,7 +2,6 @@
 #logs.vntx.net
 radius.vntx.net
 vpn.vntx.net
-librenms.vntx.net
 netbox.vntx.net
 #ntp.vntx.net
 unimus.vntx.net
@@ -12,7 +11,7 @@ monitor.vntx.net
 
 [home_servers]
 skippy.w5isp.com
-mail.mcintire.me ansible_host=204.110.191.5
+mail.mcintire.me ansible_host=107.174.178.20
 dokku.w5isp.com
 camper
 

ansible/playbook.yml

@@ -15,91 +15,95 @@
       community.general.timezone:
         name: "{{ timezone }}"
 
-- name: Apply resolver config
+# Resolver play disabled - no hosts in resolvers group
-  hosts: resolvers
+#- name: Apply resolver config
-  gather_facts: true
+#  hosts: resolvers
-  roles:
+#  gather_facts: true
-    - { role: resolvers, become: true }
+#  roles:
+#    - { role: resolvers, become: true }
 
-- name: Apply ns config
+# NS play disabled - replaced by BIND9 play below
-  hosts: ns
+#- name: Apply ns config
-  gather_facts: true
+#  hosts: ns
-  become: true
+#  gather_facts: true
-  roles:
+#  become: true
-    - role: ns
+#  roles:
+#    - role: ns
 
-- name: Apply netbox config
+# NetBox plays disabled - no hosts in netbox group
-  hosts: netbox
+#- name: Apply netbox config
-  gather_facts: true
+#  hosts: netbox
-  become: true
+#  gather_facts: true
-  roles:
+#  become: true
-    - role: caddy_ansible.caddy_ansible
+#  roles:
-      caddy_systemd_network_dependency: true
+#    - role: caddy_ansible.caddy_ansible
-      caddy_setcap: true
+#      caddy_systemd_network_dependency: true
-      caddy_systemd_capabilities_enabled: true
+#      caddy_setcap: true
-      caddy_systemd_capabilities: "CAP_NET_BIND_SERVICE"
+#      caddy_systemd_capabilities_enabled: true
-      caddy_config: |
+#      caddy_systemd_capabilities: "CAP_NET_BIND_SERVICE"
-        {{ netbox.domain }} {
+#      caddy_config: |
-            bind {{ netbox.bind_address }}
+#        {{ netbox.domain }} {
-            log {
+#            bind {{ netbox.bind_address }}
-              level error
+#            log {
-            }
+#              level error
-            route /static* {
+#            }
-              uri strip_prefix /static
+#            route /static* {
-              root * /opt/netbox/netbox/static
+#              uri strip_prefix /static
-              file_server
+#              root * /opt/netbox/netbox/static
-            }
+#              file_server
-            @notStatic not path /static*
+#            }
-            encode gzip zstd
+#            @notStatic not path /static*
-            reverse_proxy @notStatic http://localhost:{{ netbox.port }} {
+#            encode gzip zstd
-                header_up Host {http.request.host}
+#            reverse_proxy @notStatic http://localhost:{{ netbox.port }} {
-                header_up X-Real-IP {http.request.remote.host}
+#                header_up Host {http.request.host}
-                header_up X-Forwarded-For {http.request.remote.host}
+#                header_up X-Real-IP {http.request.remote.host}
-                header_up X-Forwarded-Port {http.request.port}
+#                header_up X-Forwarded-For {http.request.remote.host}
-                header_up X-Forwarded-Proto {http.request.scheme}
+#                header_up X-Forwarded-Port {http.request.port}
-            }
+#                header_up X-Forwarded-Proto {http.request.scheme}
-        }
+#            }
+#        }
+#
+#- name: Apply firewall rules to netbox
+#  hosts: netbox
+#  become: true
+#  # remote_user: graham
+#  handlers:
+#    - import_tasks: playbook_handlers.yml
+#
+#  tasks:
+#    - name: Permit traffic in default zone for http service
+#      ansible.posix.firewalld:
+#        zone: public
+#        service: http
+#        permanent: true
+#        state: enabled
+#
+#    - name: Permit traffic in default zone for https service
+#      ansible.posix.firewalld:
+#        zone: public
+#        service: https
+#        permanent: true
+#        state: enabled
+#      notify:
+#        - Restart firewalld
 
-- name: Apply firewall rules to netbox
+# Tailscale play disabled - no hosts in tailscale_home group
-  hosts: netbox
+#- name: Tailscale
-  become: true
+#  hosts: tailscale_home
-  # remote_user: graham
+#  become: true
-  handlers:
+#  gather_facts: true
-    - import_tasks: playbook_handlers.yml
+#  vars:
-
+#    inject_facts_as_vars: false
-  tasks:
+#  roles:
-    - name: Permit traffic in default zone for http service
+#    - role: artis3n.tailscale
-      ansible.posix.firewalld:
+#      vars:
-        zone: public
+#        # Pull Tailscale auth key from environment variable
-        service: http
+#        tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_KEY') }}"
-        permanent: true
+#        tailscale_args: "--ssh --advertise-exit-node"
-        state: enabled
+#  pre_tasks:
-
+#    - name: Debug - Check Tailscale key (will be partially redacted)
-    - name: Permit traffic in default zone for https service
+#      debug:
-      ansible.posix.firewalld:
+#        msg: "Key exists and starts with: {{ lookup('ansible.builtin.env', 'TAILSCALE_KEY')[0:10] }}..."
-        zone: public
-        service: https
-        permanent: true
-        state: enabled
-      notify:
-        - Restart firewalld
-
-- name: Tailscale
-  hosts: tailscale_home
-  become: true
-  gather_facts: true
-  vars:
-    inject_facts_as_vars: false
-  roles:
-    - role: artis3n.tailscale
-      vars:
-        # Pull Tailscale auth key from environment variable
-        tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_KEY') }}"
-        tailscale_args: "--ssh --advertise-exit-node"
-  pre_tasks:
-    - name: Debug - Check Tailscale key (will be partially redacted)
-      debug:
-        msg: "Key exists and starts with: {{ lookup('ansible.builtin.env', 'TAILSCALE_KEY')[0:10] }}..."
 
 - name: Install and configure Caddy
   hosts: caddy_servers
@@ -152,6 +156,7 @@
     - dns
     - bind9
     - provision
+    - never
   vars:
     # Proxmox connection settings (matches terraform/variables.tf)
     proxmox_node: "{{ lookup('env', 'PROXMOX_NODE') | default('vm2-380', true) }}"
@@ -274,10 +279,11 @@
   tags:
     - general
 
-- name: Syncthing servers
+# Syncthing play disabled - no hosts in syncthing_servers group
-  hosts: syncthing_servers
+#- name: Syncthing servers
-  become: yes
+#  hosts: syncthing_servers
-  become_method: sudo
+#  become: yes
-  tags: syncthing
+#  become_method: sudo
-  roles:
+#  tags: syncthing
-    - syncthing
+#  roles:
+#    - syncthing

ansible/roles/base/defaults/main.yml

@@ -50,7 +50,6 @@ base_packages_by_distribution:
     - fzf
     - qemu-guest-agent
     - python3-apt
-    - btop
   Debian:
     - lsof
     - mosh
@@ -63,11 +62,9 @@ base_packages_by_distribution:
     - pv
     - fzf
     - qemu-guest-agent
-    - btop
   AlmaLinux:
     - bind-utils
     - lsof
-    - btop
     - mosh
     - nano
     - net-tools

ansible/roles/general/tasks/debian/icinga2.yml

@@ -35,13 +35,23 @@
   tags:
     - icinga2_cert_dir
 
+- name: Check if icinga2 CA certificate exists locally
+  stat:
+    path: "{{ playbook_dir }}/roles/general/files/var/lib/icinga2/certs/ca.crt"
+  delegate_to: localhost
+  become: false
+  register: icinga2_ca_cert_local
+  when: '"monitoring_servers" in group_names'
+
 - name: install icinga2 CA certificate
   copy:
     src: var/lib/icinga2/certs/ca.crt
     dest: "{{ base.monitoring.cert_dir }}/ca.crt"
     owner: 'nagios'
     group: 'nagios'
-  when: '"monitoring_servers" in group_names'
+  when:
+    - '"monitoring_servers" in group_names'
+    - icinga2_ca_cert_local.stat.exists | default(false)
 
 - name: check for trusted master certificate
   stat:

talos/.gitignore

@@ -0,0 +1,7 @@
+# Talos secrets and sensitive files
+secrets.yaml
+talosconfig
+
+# Temporary files
+*.tmp
+*.bak

talos/CLUSTER_CONFIG.md

@@ -0,0 +1,114 @@
+# Talos Cluster Configuration Notes
+
+## Proxmox Environment
+
+- **Proxmox Cluster ID**: 380
+- **Proxmox Node Name**: vm2-380
+- **Proxmox API**: https://10.0.0.2:8006/api2/json
+
+## Network Configuration
+
+### Private Network (Cluster Internal)
+- **Network**: 10.0.0.0/24
+- **Control Plane Nodes**:
+  - cp-1: 10.0.0.101 (DHCP)
+  - cp-2: 10.0.0.102 (DHCP)
+  - cp-3: 10.0.0.103 (DHCP)
+- **Interface**: eth0 (net0 in Proxmox, no VLAN tag)
+- **Usage**: Kubernetes API, etcd, internal pod communication
+
+### Public Network (External Services)
+- **Network**: 204.110.191.192/26
+- **Gateway**: 204.110.191.254
+- **Node IPs**:
+  - cp-1: 204.110.191.193/26 (static)
+  - cp-2: 204.110.191.194/26 (static)
+  - cp-3: 204.110.191.195/26 (static)
+- **Interface**: eth1 (net1 in Proxmox, VLAN tag 9)
+- **Usage**: MetalLB LoadBalancer services, external access
+
+### MetalLB IP Pool
+- **Range**: 204.110.191.193-215
+- **Interface**: eth1
+- **Mode**: L2 Advertisement
+- **IMPORTANT**: LoadBalancer services must use `externalTrafficPolicy: Cluster` (not `Local`) to avoid routing issues with L2 mode
+
+## Required Node Labels
+
+All nodes must have the following labels for proper CSI and scheduling:
+
+```bash
+# Topology labels for Proxmox CSI
+topology.kubernetes.io/region=380
+topology.kubernetes.io/zone=vm2-380
+
+# Platform label for CSI DaemonSet
+node.cloudprovider.kubernetes.io/platform=nocloud
+```
+
+## Proxmox VM IDs
+
+Map Kubernetes nodes to Proxmox VM IDs for CSI provider IDs:
+
+- talos-if6-e42: VM 203 → `proxmox://380/203`
+- talos-sbl-bvx: VM 202 → `proxmox://380/202`
+- talos-xgb-7n7: VM 201 → `proxmox://380/201`
+
+**Note**: These mappings may change when VMs are recreated. Update `proxmox-csi/node-providerid-patches.yaml` accordingly.
+
+## Storage Configuration
+
+- **StorageClass**: proxmox-local-lvm
+- **Backend**: Proxmox local-lvm storage
+- **Filesystem**: ext4
+- **Binding Mode**: WaitForFirstConsumer
+- **Allowed Topology**: region=380
+
+## Service Deployment Order
+
+1. **MetalLB** - LoadBalancer capability for public IPs
+2. **NFS Provisioner** - Persistent storage via NFS (10.0.0.253:/mnt/k8s/cluster)
+3. **Tailscale Operator** - Private network access to services
+4. **DNS Services** - PowerDNS with external PostgreSQL
+5. **Other services** - As needed
+
+## External Dependencies
+
+### PostgreSQL Database
+- **Host**: 10.0.0.252
+- **Database**: powerdns
+- **User**: powerdns
+- **Running on**: Proxmox (outside Kubernetes)
+- **Credentials**: Stored in 1Password (item: t3nqhjmeci6msx4qouu64yfr3q)
+- **PowerDNS Version**: 4.8 (uses `Primary`/`Secondary` instead of `Master`/`Slave`)
+- **Zone Type**: All zones must be type `Primary` to support AXFR zone transfers
+- **AXFR Settings**:
+  - `allow-axfr-ips=204.87.183.53` - Allow zone transfers from secondary
+  - `also-notify=204.87.183.53` - Send notifications on zone updates
+
+### NFS Storage
+- **Server**: 10.0.0.253
+- **Export**: /mnt/k8s/cluster
+- **Provider**: TrueNAS
+- **Configuration**: Maproot user/group set to root
+
+### Tailscale
+- **OAuth Credentials**: Stored in 1Password (item: almzem6nffphe3xv4pgxpkbaga)
+- **Namespace**: tailscale
+- **PodSecurity**: Must be set to 'privileged' for proxy pods to run
+
+## Bootstrap Checklist
+
+After recreating cluster:
+
+- [ ] Apply node configs via talosctl
+- [ ] Bootstrap cluster: `talosctl -n 10.0.0.101 bootstrap`
+- [ ] Get kubeconfig: `talosctl kubeconfig --force`
+- [ ] Remove control-plane taint: `kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule-`
+- [ ] Deploy MetalLB for public LoadBalancer IPs
+- [ ] Deploy NFS provisioner (10.0.0.253:/mnt/k8s/cluster)
+- [ ] Deploy Tailscale operator:
+  - [ ] Set tailscale namespace to privileged PodSecurity
+  - [ ] Install operator with OAuth credentials from 1Password
+- [ ] Verify external PostgreSQL is running (10.0.0.252)
+- [ ] Deploy DNS services (PowerDNS)

talos/apply-configs.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")"
+
+echo "Applying configs to nodes..."
+
+echo "  Applying config to talos-cp-1 (10.0.0.101)"
+talosctl apply-config --insecure --nodes 10.0.0.101 --file nodes/cp-1.yaml --mode=auto
+
+echo "  Applying config to talos-cp-2 (10.0.0.102)"
+talosctl apply-config --insecure --nodes 10.0.0.102 --file nodes/cp-2.yaml --mode=auto
+
+echo "  Applying config to talos-cp-3 (10.0.0.103)"
+talosctl apply-config --insecure --nodes 10.0.0.103 --file nodes/cp-3.yaml --mode=auto
+
+echo ""
+echo "Configs applied! Nodes will reboot and configure themselves."
+echo "Wait about 2-3 minutes, then run:"
+echo ""
+echo "  # Merge talosconfig"
+echo "  talosctl config merge talosconfig"
+echo ""
+echo "  # Bootstrap the cluster (only run once!)"
+echo "  talosctl bootstrap --nodes 10.0.0.101"
+echo ""
+echo "  # Check cluster health"
+echo "  talosctl health --nodes 10.0.0.101,10.0.0.102,10.0.0.103"

talos/apply-worker-configs.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")"
+
+WORKER_IPS=(10.0.0.104 10.0.0.105 10.0.0.106)
+WORKER_NAMES=(worker-1 worker-2 worker-3)
+
+echo "=== Applying Talos Worker Node Configurations ==="
+echo ""
+
+# Apply worker configs
+for i in "${!WORKER_IPS[@]}"; do
+    IP=${WORKER_IPS[$i]}
+    NAME=${WORKER_NAMES[$i]}
+
+    echo "Applying config to $NAME ($IP)..."
+    talosctl apply-config \
+        --nodes $IP \
+        --file nodes/$NAME.yaml \
+        --insecure
+
+    echo "  ✓ Applied to $NAME"
+    echo ""
+done
+
+echo "=== Worker nodes configured! ==="
+echo ""
+echo "The worker nodes will now join the cluster."
+echo "Waiting for nodes to appear in cluster..."
+sleep 15
+
+# Get the worker node names (they're auto-generated)
+WORKER_NODES=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | grep -v -f <(kubectl get nodes -l node-role.kubernetes.io/control-plane -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') 2>/dev/null || true)
+
+if [ -n "$WORKER_NODES" ]; then
+    echo "Found worker nodes, applying labels..."
+    for node in $WORKER_NODES; do
+        echo "  Labeling $node..."
+        kubectl label node $node \
+            topology.kubernetes.io/region=380 \
+            topology.kubernetes.io/zone=vm2-380 \
+            node.cloudprovider.kubernetes.io/platform=nocloud \
+            node-role.kubernetes.io/worker= \
+            --overwrite
+    done
+    echo ""
+    echo "Worker nodes labeled successfully!"
+    kubectl get nodes
+else
+    echo "No worker nodes found yet. Label them manually with:"
+    echo "  kubectl label node <node-name> topology.kubernetes.io/region=380 topology.kubernetes.io/zone=vm2-380 node.cloudprovider.kubernetes.io/platform=nocloud node-role.kubernetes.io/worker="
+fi

talos/cert-manager/letsencrypt-clusterissuer.yaml

@@ -0,0 +1,35 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # Production Let's Encrypt server
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: graham@mcintire.me
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    # HTTP-01 solver with standalone pod
+    # cert-manager will create temporary pods to respond to challenges
+    - http01:
+        ingress:
+          ingressClassName: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    # Staging Let's Encrypt server (for testing, has higher rate limits)
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: graham@mcintire.me
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+    # HTTP-01 solver with standalone pod
+    # cert-manager will create temporary pods to respond to challenges
+    - http01:
+        ingress:
+          ingressClassName: traefik

talos/controlplane.yaml

@@ -0,0 +1,403 @@
+version: v1alpha1 # Indicates the schema used to decode the contents.
+debug: false # Enable verbose logging to the console.
+persist: true
+# Provides machine specific configuration options.
+machine:
+    type: controlplane # Defines the role of the machine within the cluster.
+    token: gwdkoe.5gbblli1cvxv1axx # The `token` is used by a machine to join the PKI of the cluster.
+    # The root certificate authority of the PKI.
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
+    # Extra certificate subject alternative names for the machine's certificate.
+    certSANs: []
+    #   # Uncomment this to enable SANs.
+    #   - 10.0.0.10
+    #   - 172.16.0.10
+    #   - 192.168.0.10
+
+    # Used to provide additional options to the kubelet.
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
+        # The `extraMounts` field is used to add additional mounts to the kubelet container.
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins # Destination is the absolute path where the mount will be placed in the container.
+              type: bind # Type specifies the mount kind.
+              source: /var/lib/kubelet/plugins # Source specifies the source path of the mount.
+              # Options are fstab style mount options.
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
+        disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
+        
+        # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
+        # clusterDNS:
+        #     - 10.96.0.10
+        #     - 169.254.2.53
+
+        # # The `extraArgs` field is used to provide additional flags to the kubelet.
+        # extraArgs:
+        #     key: value
+
+        # # The `extraConfig` field is used to provide kubelet configuration overrides.
+        # extraConfig:
+        #     serverTLSBootstrap: true
+
+        # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
+        # credentialProviderConfig:
+        #     apiVersion: kubelet.config.k8s.io/v1
+        #     kind: CredentialProviderConfig
+        #     providers:
+        #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
+        #           defaultCacheDuration: 12h
+        #           matchImages:
+        #             - '*.dkr.ecr.*.amazonaws.com'
+        #             - '*.dkr.ecr.*.amazonaws.com.cn'
+        #             - '*.dkr.ecr-fips.*.amazonaws.com'
+        #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
+        #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
+        #           name: ecr-credential-provider
+
+        # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
+        # nodeIP:
+        #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
+        #     validSubnets:
+        #         - 10.0.0.0/8
+        #         - '!10.0.0.3/32'
+        #         - fdc7::/16
+    # Provides machine specific network configuration options.
+    network: {}
+    # # Configures KubeSpan feature.
+    # kubespan:
+    #     enabled: true # Enable the KubeSpan feature.
+
+    # Used to provide instructions for installations.
+    install:
+        disk: /dev/sda # The disk used for installations.
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 # Allows for supplying the image used to perform the installation.
+        wipe: false # Indicates if the installation disk should be wiped at installation time.
+        grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
+        
+        # # Look up disk using disk attributes like model, size, serial and others.
+        # diskSelector:
+        #     size: 4GB # Disk size.
+        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
+        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
+    # Allows the addition of user specified files.
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG # The contents of the file.
+          permissions: 0o600 # The file's permissions in octal.
+          path: /var/etc/tailscale/auth.key # The path of the file.
+          op: create # The operation to use
+        - content: 10.0.0.0/24 # The contents of the file.
+          permissions: 0o600 # The file's permissions in octal.
+          path: /var/etc/tailscale/routes # The path of the file.
+          op: create # The operation to use
+        - content: --accept-routes --advertise-tags=tag:k8s-cp # The contents of the file.
+          permissions: 0o600 # The file's permissions in octal.
+          path: /var/etc/tailscale/args # The path of the file.
+          op: create # The operation to use
+    # Features describe individual Talos features that can be switched on or off.
+    features:
+        diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
+        # KubePrism - local proxy/load balancer on defined port that will distribute
+        kubePrism:
+            enabled: true # Enable KubePrism support - will start local load balancing proxy.
+            port: 7445 # KubePrism port.
+        # Configures host DNS caching resolver.
+        hostDNS:
+            enabled: true # Enable host DNS caching resolver.
+            forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
+        
+        # # Configure Talos API access from Kubernetes pods.
+        # kubernetesTalosAPIAccess:
+        #     enabled: true # Enable Talos API access from Kubernetes pods.
+        #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
+        #     allowedRoles:
+        #         - os:reader
+        #     # The list of Kubernetes namespaces Talos API access is available from.
+        #     allowedKubernetesNamespaces:
+        #         - kube-system
+    # Configures the node labels for the machine.
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+    
+    # # Provides machine specific control plane configuration options.
+
+    # # ControlPlane definition example.
+    # controlPlane:
+    #     # Controller manager machine specific configuration options.
+    #     controllerManager:
+    #         disabled: false # Disable kube-controller-manager on the node.
+    #     # Scheduler machine specific configuration options.
+    #     scheduler:
+    #         disabled: true # Disable kube-scheduler on the node.
+
+    # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
+
+    # # nginx static pod.
+    # pods:
+    #     - apiVersion: v1
+    #       kind: pod
+    #       metadata:
+    #         name: nginx
+    #       spec:
+    #         containers:
+    #             - image: nginx
+    #               name: nginx
+
+    # # The `env` field allows for the addition of environment variables.
+
+    # # Environment variables definition examples.
+    # env:
+    #     GRPC_GO_LOG_SEVERITY_LEVEL: info
+    #     GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
+    #     https_proxy: http://SERVER:PORT/
+    # env:
+    #     GRPC_GO_LOG_SEVERITY_LEVEL: error
+    #     https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
+    # env:
+    #     https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
+
+    # # Used to configure the machine's sysctls.
+
+    # # MachineSysctls usage example.
+    # sysctls:
+    #     kernel.domainname: talos.dev
+    #     net.ipv4.ip_forward: "0"
+    #     net/ipv6/conf/eth0.100/disable_ipv6: "1"
+
+    # # Used to configure the machine's sysfs.
+
+    # # MachineSysfs usage example.
+    # sysfs:
+    #     devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
+
+    # # Configures the udev system.
+    # udev:
+    #     # List of udev rules to apply to the udev system
+    #     rules:
+    #         - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
+
+    # # Configures the logging system.
+    # logging:
+    #     # Logging destination.
+    #     destinations:
+    #         - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
+    #           format: json_lines # Logs format.
+
+    # # Configures the kernel.
+    # kernel:
+    #     # Kernel modules to load.
+    #     modules:
+    #         - name: btrfs # Module name.
+
+    # # Configures the seccomp profiles for the machine.
+    # seccompProfiles:
+    #     - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
+    #       # The `value` field is used to provide the seccomp profile.
+    #       value:
+    #         defaultAction: SCMP_ACT_LOG
+
+    # # Override (patch) settings in the default OCI runtime spec for CRI containers.
+
+    # # override default open file limit
+    # baseRuntimeSpecOverrides:
+    #     process:
+    #         rlimits:
+    #             - hard: 1024
+    #               soft: 1024
+    #               type: RLIMIT_NOFILE
+
+    # # Configures the node annotations for the machine.
+
+    # # node annotations example.
+    # nodeAnnotations:
+    #     customer.io/rack: r13a25
+
+    # # Configures the node taints for the machine. Effect is optional.
+
+    # # node taints example.
+    # nodeTaints:
+    #     exampleTaint: exampleTaintValue:NoSchedule
+# Provides cluster specific configuration options.
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= # Shared secret of cluster (base64 encoded random 32 bytes).
+    # Provides control plane specific configuration options.
+    controlPlane:
+        endpoint: https://10.0.0.101:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
+    clusterName: vntx # Configures the cluster's name.
+    # Provides cluster specific network configuration options.
+    network:
+        dnsDomain: cluster.local # The domain used by Kubernetes DNS.
+        # The pod subnet CIDR.
+        podSubnets:
+            - 10.244.0.0/16
+        # The service subnet CIDR.
+        serviceSubnets:
+            - 10.96.0.0/12
+        
+        # # The CNI used.
+        # cni:
+        #     name: custom # Name of CNI to use.
+        #     # URLs containing manifests to apply for the CNI.
+        #     urls:
+        #         - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
+    token: 71gr3x.96za7btksx23r8bk # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
+    # The base64 encoded root certificate authority used by Kubernetes.
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    # The base64 encoded private key for service account token generation.
+    serviceAccount:
+        key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+    # API server specific configuration options.
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
+        # Configure the API server admission plugins.
+        admissionControl:
+            - name: PodSecurity # Name is the name of the admission controller.
+              # Configuration is an embedded configuration object to be used as the plugin's
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        # Configure the API server audit policy.
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+        
+        # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
+        # authorizationConfig:
+        #     - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
+        #       name: webhook # Name is used to describe the authorizer.
+        #       # webhook is the configuration for the webhook authorizer.
+        #       webhook:
+        #         connectionInfo:
+        #             type: InClusterConfig
+        #         failurePolicy: Deny
+        #         matchConditionSubjectAccessReviewVersion: v1
+        #         matchConditions:
+        #             - expression: has(request.resourceAttributes)
+        #             - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
+        #         subjectAccessReviewVersion: v1
+        #         timeout: 3s
+        #     - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
+        #       name: in-cluster-authorizer # Name is used to describe the authorizer.
+        #       # webhook is the configuration for the webhook authorizer.
+        #       webhook:
+        #         connectionInfo:
+        #             type: InClusterConfig
+        #         failurePolicy: NoOpinion
+        #         matchConditionSubjectAccessReviewVersion: v1
+        #         subjectAccessReviewVersion: v1
+        #         timeout: 3s
+    # Controller manager server specific configuration options.
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
+    # Kube-proxy server-specific configuration options
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
+        
+        # # Disable kube-proxy deployment on cluster bootstrap.
+        # disabled: false
+    # Scheduler server specific configuration options.
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
+    # Configures cluster member discovery.
+    discovery:
+        enabled: true # Enable the cluster membership discovery feature.
+        # Configure registries used for cluster member discovery.
+        registries:
+            # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
+            kubernetes:
+                disabled: true # Disable Kubernetes discovery registry.
+            # Service registry is using an external service to push and pull information about cluster members.
+            service: {}
+            # # External service endpoint.
+            # endpoint: https://discovery.talos.dev/
+    # Etcd specific configuration options.
+    etcd:
+        # The `ca` is the root certificate authority of the PKI.
+        ca:
+            crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+            key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+        
+        # # The container image used to create the etcd service.
+        # image: registry.k8s.io/etcd:v3.6.7
+
+        # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
+        # advertisedSubnets:
+        #     - 10.0.0.0/8
+    # A list of urls that point to additional manifests.
+    extraManifests: []
+    #   - https://www.example.com/manifest1.yaml
+    #   - https://www.example.com/manifest2.yaml
+
+    # A list of inline Kubernetes manifests.
+    inlineManifests: []
+    #   - name: namespace-ci # Name of the manifest.
+    #     contents: |- # Manifest contents as a string.
+    #       apiVersion: v1
+    #       kind: Namespace
+    #       metadata:
+    #       	name: ci
+
+    
+    # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
+
+    # # Decryption secret example (do not use in production!).
+    # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
+
+    # # Core DNS specific configuration options.
+    # coreDNS:
+    #     image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
+
+    # # External cloud provider configuration.
+    # externalCloudProvider:
+    #     enabled: true # Enable external cloud provider.
+    #     # A list of urls that point to additional manifests for an external cloud provider.
+    #     manifests:
+    #         - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
+    #         - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
+
+    # # A map of key value pairs that will be added while fetching the extraManifests.
+    # extraManifestHeaders:
+    #     Token: "1234567"
+    #     X-ExtraInfo: info
+
+    # # Settings for admin kubeconfig generation.
+    # adminKubeconfig:
+    #     certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
+
+    # # Allows running workload on control-plane nodes.
+    # allowSchedulingOnControlPlanes: true
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable # A method to automatically generate a hostname for the machine.
+
+# # A static hostname to set for the machine.
+# hostname: controlplane1
+# hostname: controlplane1.example.org

talos/current-config.yaml

@@ -0,0 +1 @@
+rpc error: code = NotFound desc = resource "config" is not registered

talos/deploy-cluster-services.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Talos Cluster Services Deployment Script
+# This script deploys core infrastructure services in the correct order
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+VNTX_INFRA_DIR="$(dirname "$SCRIPT_DIR")"
+
+echo "=== Talos Cluster Services Deployment ==="
+echo ""
+
+# Color output
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+step() {
+    echo -e "${GREEN}==>${NC} $1"
+}
+
+wait_for_pods() {
+    local namespace=$1
+    local label=$2
+    local timeout=${3:-120}
+
+    echo "Waiting for pods in namespace $namespace with label $label..."
+    kubectl wait --for=condition=ready pod \
+        -l "$label" \
+        -n "$namespace" \
+        --timeout="${timeout}s" 2>/dev/null || true
+}
+
+# Step 0: Remove control-plane taint
+step "0. Removing control-plane taint..."
+kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule- 2>/dev/null || echo "Taint already removed or not present"
+
+echo ""
+
+# Step 1: Deploy MetalLB
+step "1. Deploying MetalLB..."
+kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.9/config/manifests/metallb-native.yaml
+
+echo "Waiting for MetalLB controller..."
+wait_for_pods metallb-system component=controller 120
+
+# Create memberlist secret if needed
+kubectl get secret -n metallb-system memberlist &>/dev/null || \
+    kubectl create secret generic -n metallb-system memberlist \
+    --from-literal=secretkey="$(openssl rand -base64 128)"
+
+echo "Waiting for MetalLB speakers..."
+wait_for_pods metallb-system component=speaker 120
+
+step "Applying MetalLB IP pool configuration..."
+kubectl apply -f "$VNTX_INFRA_DIR/contexts/metallb/ipaddresspool.yaml"
+
+echo ""
+
+# Step 2: Deploy NFS Provisioner
+step "2. Deploying NFS Provisioner..."
+helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/ 2>/dev/null || true
+helm repo update
+
+helm upgrade --install nfs-subdir-external-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
+  --namespace nfs-provisioner \
+  --create-namespace \
+  --set nfs.server=10.0.0.253 \
+  --set nfs.path=/mnt/k8s/cluster \
+  --set storageClass.name=nfs \
+  --set storageClass.defaultClass=true \
+  --set storageClass.reclaimPolicy=Delete \
+  --wait
+
+echo ""
+
+# Step 3: Deploy Tailscale Operator
+step "3. Deploying Tailscale Operator..."
+
+# Set namespace to privileged for Tailscale proxies
+kubectl create namespace tailscale 2>/dev/null || true
+kubectl label namespace tailscale \
+  pod-security.kubernetes.io/enforce=privileged \
+  pod-security.kubernetes.io/audit=privileged \
+  pod-security.kubernetes.io/warn=privileged \
+  --overwrite
+
+# Get Tailscale OAuth credentials from 1Password
+TAILSCALE_CLIENT_ID=$(op item get almzem6nffphe3xv4pgxpkbaga --account=YOOATCZZSVGH7AD6VABUVPORLI --fields client_id --reveal)
+TAILSCALE_CLIENT_SECRET=$(op item get almzem6nffphe3xv4pgxpkbaga --account=YOOATCZZSVGH7AD6VABUVPORLI --fields client_secret --reveal)
+
+helm repo add tailscale https://pkgs.tailscale.com/helmcharts 2>/dev/null || true
+helm repo update
+
+helm upgrade --install tailscale-operator tailscale/tailscale-operator \
+  --namespace=tailscale \
+  --set-string oauth.clientId="$TAILSCALE_CLIENT_ID" \
+  --set-string oauth.clientSecret="$TAILSCALE_CLIENT_SECRET" \
+  --wait
+
+echo ""
+
+# Step 4: Deploy DNS Services (PowerDNS)
+step "4. Deploying DNS Services (PowerDNS)..."
+
+# Create PostgreSQL credentials secret from 1Password
+kubectl create secret generic postgresql-credentials -n dns \
+  --from-literal="POSTGRES_USER=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_USER --reveal)" \
+  --from-literal="POSTGRES_PASSWORD=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_PASSWORD --reveal)" \
+  --from-literal="POSTGRES_DB=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_DB --reveal)" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Create PowerDNS API secret from 1Password
+kubectl create secret generic powerdns-secrets -n dns \
+  --from-literal="API_KEY=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POWERDNS_API_KEY --reveal)" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Create PowerDNS config
+kubectl create configmap powerdns-config -n dns --from-literal="pdns.conf=launch=gpgsql
+gpgsql-host=10.0.0.252
+gpgsql-port=5432
+gpgsql-dbname=powerdns
+gpgsql-user=powerdns
+gpgsql-password=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_PASSWORD --reveal)
+gpgsql-dnssec=yes
+
+receiver-threads=4
+distributor-threads=4
+reuseport=yes
+max-tcp-connections=100
+
+api=yes
+api-key=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POWERDNS_API_KEY --reveal)
+webserver=yes
+webserver-address=0.0.0.0
+webserver-port=8081
+webserver-allow-from=0.0.0.0/0
+webserver-max-bodysize=10485760
+
+local-address=0.0.0.0
+local-port=53
+
+log-dns-queries=yes
+loglevel=6" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Deploy PowerDNS services and deployment
+kubectl apply -f "$VNTX_INFRA_DIR/contexts/dns/powerdns-service.yaml"
+kubectl apply -f "$VNTX_INFRA_DIR/contexts/dns/powerdns-deployment.yaml"
+
+echo "Waiting for PowerDNS..."
+wait_for_pods dns app=powerdns 120
+
+echo ""
+
+# Step 5: Verify deployment
+step "5. Verifying deployment..."
+
+echo ""
+echo "MetalLB Status:"
+kubectl get pods -n metallb-system
+echo ""
+kubectl get ipaddresspool,l2advertisement -n metallb-system
+
+echo ""
+echo "NFS Provisioner Status:"
+kubectl get pods -n nfs-provisioner
+echo ""
+kubectl get storageclass
+
+echo ""
+echo "Tailscale Operator Status:"
+kubectl get pods -n tailscale
+echo ""
+
+echo ""
+echo "DNS Services Status:"
+kubectl get pods,svc -n dns
+
+echo ""
+echo -e "${GREEN}=== Deployment Complete ===${NC}"
+echo ""
+echo "Services deployed:"
+echo "  - MetalLB (Public LoadBalancer)"
+echo "  - NFS Provisioner (Storage from 10.0.0.253)"
+echo "  - Tailscale Operator (Private network access)"
+echo "  - PowerDNS (Authoritative DNS)"
+echo ""
+echo "External Dependencies:"
+echo "  - PostgreSQL: 10.0.0.252"
+echo "  - NFS: 10.0.0.253:/mnt/k8s/cluster"
+echo ""
+echo "LoadBalancer Services:"
+kubectl get svc --all-namespaces -o wide | grep LoadBalancer || echo "  No LoadBalancer services yet"

talos/generate-node-configs.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")"
+
+echo "Generating individual node configs..."
+
+# Generate control plane configs
+for node in cp-1 cp-2 cp-3; do
+  echo "  Creating nodes/${node}.yaml (control plane)"
+  talosctl machineconfig patch controlplane.yaml \
+    --patch @patches/cloud-provider.yaml \
+    --patch @patches/${node}.yaml \
+    -o nodes/${node}.yaml
+done
+
+# Generate worker configs
+for node in worker-1 worker-2 worker-3; do
+  echo "  Creating nodes/${node}.yaml (worker)"
+  talosctl machineconfig patch worker-base.yaml \
+    --patch @patches/cloud-provider.yaml \
+    --patch @patches/${node}.yaml \
+    -o nodes/${node}.yaml
+done
+
+echo "Done! Node configs created in nodes/"

talos/kubeconfig

@@ -0,0 +1,28 @@
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    server: https://10.0.0.101:6443
+  name: vntx
+contexts:
+- context:
+    cluster: vntx
+    namespace: default
+    user: admin@vntx
+  name: admin@vntx
+- context:
+    cluster: vntx
+    namespace: default
+    user: admin@vntx-1
+  name: vntx
+current-context: admin@vntx
+kind: Config
+users:
+- name: admin@vntx
+  user:
+    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoakNDQVN1Z0F3SUJBZ0lSQUxPR2NEbnd5alVRc1pBZTBXdUlQZUl3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TURFeU1UVTRNVGxhRncweU56QXhNREV5TVRVNApNamxhTUNreEZ6QVZCZ05WQkFvVERuTjVjM1JsYlRwdFlYTjBaWEp6TVE0d0RBWURWUVFERXdWaFpHMXBiakJaCk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkEvQ1VyajRzbTI3TG9sOVQ1cjhzMFZsQ0lKZmNEcUUKaTljcnp1M0lUdDYzbG9CVVByMXZyTVFwSzBvSEFsWmd5SjArSHVERjIrUElUU1JMQ1ZVcFFzcWpTREJHTUE0RwpBMVVkRHdFQi93UUVBd0lGb0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFqQWZCZ05WSFNNRUdEQVdnQlNkClhCd1cwa2VwQllHZHM1N0NwNm41bzgrczNEQUtCZ2dxaGtqT1BRUURBZ05KQURCR0FpRUExTmRjcUxPRmpUc1cKT3RRalhNeU1ucGZPMDJMQTFma1U0NHYzaERscTZ1TUNJUURBOEQyT29vdXk2K2JkNkoxeUs3UGIzeU9ud0JlcgpyY0lGM1luMlg1ZTFvZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUh2U2dSVVhyK1NYVTRZUTJCdTVUWWVoL2tZRFBsczd6Mm9mSU9ad3ZHR05vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRDhKU3VQaXliYnN1aVgxUG12eXpSV1VJZ2w5d09vU0wxeXZPN2NoTzNyZVdnRlErdlcrcwp4Q2tyU2djQ1ZtREluVDRlNE1YYjQ4aE5KRXNKVlNsQ3lnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+- name: admin@vntx-1
+  user:
+    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoVENDQVN1Z0F3SUJBZ0lSQUtHcFVGbUpJaTh4cGwzUzN0bmRRZ3N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV5TWpnd01EQTFOVGRhRncweU5qRXlNamd3TURBMgpNRGRhTUNreEZ6QVZCZ05WQkFvVERuTjVjM1JsYlRwdFlYTjBaWEp6TVE0d0RBWURWUVFERXdWaFpHMXBiakJaCk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkRtZldUV2RnWXh1V3RIREE0NkdpS2VSTkRmc010ZGcKNnlYSUtRbzRsNVNabFFwaWs4ZXp1em9rQlIvUXdjYVJ1bGlEUktkOWlobGpIeGtWbDFPKzZnbWpTREJHTUE0RwpBMVVkRHdFQi93UUVBd0lGb0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFqQWZCZ05WSFNNRUdEQVdnQlNkClhCd1cwa2VwQllHZHM1N0NwNm41bzgrczNEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQTFrVWlsUmQ5MGdQc0MKRk5JZ2c5QkZzbUJzV1RBaDhJN05mRVFvMWxaeG1BSWhBSnZ6L2IzSnZ1T2V3UWUyNm54WloycWZuYStpemlRawo2VTlIVlZzNU5jZEoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNjK3UvaFFWVHB3V2RDSEt1U2ZneTlCMStYWml6ME1mcnVQS1N1eS9TV1NvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFT1o5Wk5aMkJqRzVhMGNNRGpvYUlwNUUwTit3eTEyRHJKY2dwQ2ppWGxKbVZDbUtUeDdPNwpPaVFGSDlEQnhwRzZXSU5FcDMyS0dXTWZHUldYVTc3cUNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=

talos/metallb/ipaddresspool-internal.yaml

@@ -0,0 +1,20 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: internal-pool
+  namespace: metallb-system
+spec:
+  addresses:
+  - 10.0.0.10-10.0.0.99
+  autoAssign: true
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: internal-l2
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+  - internal-pool
+  interfaces:
+  - eth0

talos/nodes/cp-1.yaml

@@ -0,0 +1,124 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+    type: controlplane
+    token: gwdkoe.5gbblli1cvxv1axx
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
+    certSANs: []
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0
+        extraArgs:
+            cloud-provider: external
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins
+              type: bind
+              source: /var/lib/kubelet/plugins
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true
+        disableManifestsDirectory: true
+    network:
+        interfaces:
+            - interface: eth0
+              dhcp: true
+            - interface: eth1
+              dhcp: false
+    install:
+        disk: /dev/sda
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
+        wipe: false
+        grubUseUKICmdline: true
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
+          permissions: 0o600
+          path: /var/etc/tailscale/auth.key
+          op: create
+        - content: 10.0.0.0/24
+          permissions: 0o600
+          path: /var/etc/tailscale/routes
+          op: create
+        - content: --accept-routes --advertise-tags=tag:k8s-cp
+          permissions: 0o600
+          path: /var/etc/tailscale/args
+          op: create
+    features:
+        diskQuotaSupport: true
+        kubePrism:
+            enabled: true
+            port: 7445
+        hostDNS:
+            enabled: true
+            forwardKubeDNSToHost: true
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
+    controlPlane:
+        endpoint: https://10.0.0.101:6443
+    clusterName: vntx
+    network:
+        dnsDomain: cluster.local
+        podSubnets:
+            - 10.244.0.0/16
+        serviceSubnets:
+            - 10.96.0.0/12
+    token: 71gr3x.96za7btksx23r8bk
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    serviceAccount:
+        key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0
+        admissionControl:
+            - name: PodSecurity
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0
+    discovery:
+        enabled: true
+        registries:
+            kubernetes:
+                disabled: true
+            service: {}
+    etcd:
+        ca:
+            crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+            key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable

talos/nodes/cp-2.yaml

@@ -0,0 +1,124 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+    type: controlplane
+    token: gwdkoe.5gbblli1cvxv1axx
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
+    certSANs: []
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0
+        extraArgs:
+            cloud-provider: external
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins
+              type: bind
+              source: /var/lib/kubelet/plugins
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true
+        disableManifestsDirectory: true
+    network:
+        interfaces:
+            - interface: eth0
+              dhcp: true
+            - interface: eth1
+              dhcp: false
+    install:
+        disk: /dev/sda
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
+        wipe: false
+        grubUseUKICmdline: true
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
+          permissions: 0o600
+          path: /var/etc/tailscale/auth.key
+          op: create
+        - content: 10.0.0.0/24
+          permissions: 0o600
+          path: /var/etc/tailscale/routes
+          op: create
+        - content: --accept-routes --advertise-tags=tag:k8s-cp
+          permissions: 0o600
+          path: /var/etc/tailscale/args
+          op: create
+    features:
+        diskQuotaSupport: true
+        kubePrism:
+            enabled: true
+            port: 7445
+        hostDNS:
+            enabled: true
+            forwardKubeDNSToHost: true
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
+    controlPlane:
+        endpoint: https://10.0.0.101:6443
+    clusterName: vntx
+    network:
+        dnsDomain: cluster.local
+        podSubnets:
+            - 10.244.0.0/16
+        serviceSubnets:
+            - 10.96.0.0/12
+    token: 71gr3x.96za7btksx23r8bk
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    serviceAccount:
+        key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0
+        admissionControl:
+            - name: PodSecurity
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0
+    discovery:
+        enabled: true
+        registries:
+            kubernetes:
+                disabled: true
+            service: {}
+    etcd:
+        ca:
+            crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+            key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable

talos/nodes/cp-3.yaml

@@ -0,0 +1,124 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+    type: controlplane
+    token: gwdkoe.5gbblli1cvxv1axx
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
+    certSANs: []
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0
+        extraArgs:
+            cloud-provider: external
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins
+              type: bind
+              source: /var/lib/kubelet/plugins
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true
+        disableManifestsDirectory: true
+    network:
+        interfaces:
+            - interface: eth0
+              dhcp: true
+            - interface: eth1
+              dhcp: false
+    install:
+        disk: /dev/sda
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
+        wipe: false
+        grubUseUKICmdline: true
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
+          permissions: 0o600
+          path: /var/etc/tailscale/auth.key
+          op: create
+        - content: 10.0.0.0/24
+          permissions: 0o600
+          path: /var/etc/tailscale/routes
+          op: create
+        - content: --accept-routes --advertise-tags=tag:k8s-cp
+          permissions: 0o600
+          path: /var/etc/tailscale/args
+          op: create
+    features:
+        diskQuotaSupport: true
+        kubePrism:
+            enabled: true
+            port: 7445
+        hostDNS:
+            enabled: true
+            forwardKubeDNSToHost: true
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
+    controlPlane:
+        endpoint: https://10.0.0.101:6443
+    clusterName: vntx
+    network:
+        dnsDomain: cluster.local
+        podSubnets:
+            - 10.244.0.0/16
+        serviceSubnets:
+            - 10.96.0.0/12
+    token: 71gr3x.96za7btksx23r8bk
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+    serviceAccount:
+        key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0
+        admissionControl:
+            - name: PodSecurity
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0
+    discovery:
+        enabled: true
+        registries:
+            kubernetes:
+                disabled: true
+            service: {}
+    etcd:
+        ca:
+            crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+            key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable

talos/nodes/worker-1.yaml

@@ -0,0 +1,118 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+    type: worker
+    token: gwdkoe.5gbblli1cvxv1axx
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    certSANs: []
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0
+        extraArgs:
+            cloud-provider: external
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins
+              type: bind
+              source: /var/lib/kubelet/plugins
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true
+        disableManifestsDirectory: true
+    network:
+        interfaces:
+            - interface: eth0
+              dhcp: true
+    install:
+        disk: /dev/sda
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
+        wipe: false
+        grubUseUKICmdline: true
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
+          permissions: 0o600
+          path: /var/etc/tailscale/auth.key
+          op: create
+        - content: 10.0.0.0/24
+          permissions: 0o600
+          path: /var/etc/tailscale/routes
+          op: create
+        - content: --accept-routes --advertise-tags=tag:k8s-cp
+          permissions: 0o600
+          path: /var/etc/tailscale/args
+          op: create
+    features:
+        diskQuotaSupport: true
+        kubePrism:
+            enabled: true
+            port: 7445
+        hostDNS:
+            enabled: true
+            forwardKubeDNSToHost: true
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
+    controlPlane:
+        endpoint: https://10.0.0.101:6443
+    clusterName: vntx
+    network:
+        dnsDomain: cluster.local
+        podSubnets:
+            - 10.244.0.0/16
+        serviceSubnets:
+            - 10.96.0.0/12
+    token: 71gr3x.96za7btksx23r8bk
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    serviceAccount:
+        key: ""
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0
+        admissionControl:
+            - name: PodSecurity
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0
+    discovery:
+        enabled: true
+        registries:
+            kubernetes:
+                disabled: true
+            service: {}
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable

talos/nodes/worker-2.yaml

@@ -0,0 +1,118 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+    type: worker
+    token: gwdkoe.5gbblli1cvxv1axx
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    certSANs: []
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0
+        extraArgs:
+            cloud-provider: external
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins
+              type: bind
+              source: /var/lib/kubelet/plugins
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true
+        disableManifestsDirectory: true
+    network:
+        interfaces:
+            - interface: eth0
+              dhcp: true
+    install:
+        disk: /dev/sda
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
+        wipe: false
+        grubUseUKICmdline: true
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
+          permissions: 0o600
+          path: /var/etc/tailscale/auth.key
+          op: create
+        - content: 10.0.0.0/24
+          permissions: 0o600
+          path: /var/etc/tailscale/routes
+          op: create
+        - content: --accept-routes --advertise-tags=tag:k8s-cp
+          permissions: 0o600
+          path: /var/etc/tailscale/args
+          op: create
+    features:
+        diskQuotaSupport: true
+        kubePrism:
+            enabled: true
+            port: 7445
+        hostDNS:
+            enabled: true
+            forwardKubeDNSToHost: true
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
+    controlPlane:
+        endpoint: https://10.0.0.101:6443
+    clusterName: vntx
+    network:
+        dnsDomain: cluster.local
+        podSubnets:
+            - 10.244.0.0/16
+        serviceSubnets:
+            - 10.96.0.0/12
+    token: 71gr3x.96za7btksx23r8bk
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    serviceAccount:
+        key: ""
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0
+        admissionControl:
+            - name: PodSecurity
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0
+    discovery:
+        enabled: true
+        registries:
+            kubernetes:
+                disabled: true
+            service: {}
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable

talos/nodes/worker-3.yaml

@@ -0,0 +1,118 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+    type: worker
+    token: gwdkoe.5gbblli1cvxv1axx
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    certSANs: []
+    kubelet:
+        image: ghcr.io/siderolabs/kubelet:v1.35.0
+        extraArgs:
+            cloud-provider: external
+        extraMounts:
+            - destination: /var/lib/kubelet/plugins
+              type: bind
+              source: /var/lib/kubelet/plugins
+              options:
+                - bind
+                - rshared
+                - rw
+        defaultRuntimeSeccompProfileEnabled: true
+        disableManifestsDirectory: true
+    network:
+        interfaces:
+            - interface: eth0
+              dhcp: true
+    install:
+        disk: /dev/sda
+        image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
+        wipe: false
+        grubUseUKICmdline: true
+    files:
+        - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
+          permissions: 0o600
+          path: /var/etc/tailscale/auth.key
+          op: create
+        - content: 10.0.0.0/24
+          permissions: 0o600
+          path: /var/etc/tailscale/routes
+          op: create
+        - content: --accept-routes --advertise-tags=tag:k8s-cp
+          permissions: 0o600
+          path: /var/etc/tailscale/args
+          op: create
+    features:
+        diskQuotaSupport: true
+        kubePrism:
+            enabled: true
+            port: 7445
+        hostDNS:
+            enabled: true
+            forwardKubeDNSToHost: true
+    nodeLabels:
+        node.kubernetes.io/exclude-from-external-load-balancers: ""
+cluster:
+    id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
+    secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
+    controlPlane:
+        endpoint: https://10.0.0.101:6443
+    clusterName: vntx
+    network:
+        dnsDomain: cluster.local
+        podSubnets:
+            - 10.244.0.0/16
+        serviceSubnets:
+            - 10.96.0.0/12
+    token: 71gr3x.96za7btksx23r8bk
+    secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
+    ca:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    aggregatorCA:
+        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        key: ""
+    serviceAccount:
+        key: ""
+    apiServer:
+        image: registry.k8s.io/kube-apiserver:v1.35.0
+        admissionControl:
+            - name: PodSecurity
+              configuration:
+                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+                defaults:
+                    audit: restricted
+                    audit-version: latest
+                    enforce: baseline
+                    enforce-version: latest
+                    warn: restricted
+                    warn-version: latest
+                exemptions:
+                    namespaces:
+                        - kube-system
+                    runtimeClasses: []
+                    usernames: []
+                kind: PodSecurityConfiguration
+        auditPolicy:
+            apiVersion: audit.k8s.io/v1
+            kind: Policy
+            rules:
+                - level: Metadata
+    controllerManager:
+        image: registry.k8s.io/kube-controller-manager:v1.35.0
+    proxy:
+        image: registry.k8s.io/kube-proxy:v1.35.0
+    scheduler:
+        image: registry.k8s.io/kube-scheduler:v1.35.0
+    discovery:
+        enabled: true
+        registries:
+            kubernetes:
+                disabled: true
+            service: {}
+---
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: stable

talos/patches/cloud-provider.yaml

@@ -0,0 +1,4 @@
+machine:
+  kubelet:
+    extraArgs:
+      cloud-provider: external

talos/patches/cp-1.yaml

@@ -0,0 +1,7 @@
+machine:
+  network:
+    interfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: false

talos/patches/cp-2.yaml

@@ -0,0 +1,7 @@
+machine:
+  network:
+    interfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: false

talos/patches/cp-3.yaml

@@ -0,0 +1,7 @@
+machine:
+  network:
+    interfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: false

talos/patches/remove-controlplane-secrets.yaml

@@ -0,0 +1,2 @@
+# This patch is no longer needed since we manually fixed worker-base.yaml
+# Keeping file for reference but it won't be used