update for new talos k8s
This commit is contained in:
parent
4354a6b120
commit
a512babb77
24 changed files with 1451 additions and 190 deletions
15
CLAUDE.md
15
CLAUDE.md
|
|
@ -56,6 +56,21 @@ kubectl get pods -n aprs
|
|||
kubectl get svc -n aprs
|
||||
```
|
||||
|
||||
### Talos Operations
|
||||
```bash
|
||||
# Apply configuration to nodes (from cluster directory)
|
||||
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml
|
||||
|
||||
# Check node status
|
||||
talosctl --talosconfig=./talosconfig -e 10.0.101.21 get nodes
|
||||
|
||||
# Bootstrap cluster (only needed once)
|
||||
talosctl --talosconfig=./talosconfig -e 10.0.101.21 bootstrap
|
||||
|
||||
# Get kubeconfig
|
||||
talosctl --talosconfig=./talosconfig -e 10.0.101.21 kubeconfig
|
||||
```
|
||||
|
||||
|
||||
## Architecture
|
||||
|
||||
|
|
|
|||
|
|
@ -55,6 +55,16 @@ spec:
|
|||
name: aprs-config
|
||||
- secretRef:
|
||||
name: aprs-secret
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: aprs
|
||||
image: ghcr.io/aprsme/aprs.me:latest
|
||||
|
|
@ -97,4 +107,14 @@ spec:
|
|||
cpu: "250m"
|
||||
limits:
|
||||
memory: "1Gi"
|
||||
cpu: "500m"
|
||||
cpu: "500m"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
|
@ -1,10 +1,10 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
echo "Deploying APRS.me to k3s cluster at 204.110.191.2"
|
||||
echo "Deploying APRS.me to cluster at 204.110.191.2"
|
||||
|
||||
# Use homelab context
|
||||
kubectl config use-context homelab
|
||||
kubectl config use-context admin@home
|
||||
|
||||
# Create namespace
|
||||
echo "Creating namespace..."
|
||||
|
|
@ -49,4 +49,4 @@ echo ""
|
|||
echo "Remember to:"
|
||||
echo "1. Create GitHub image pull secret: ./create-image-pull-secret.sh <username> <token>"
|
||||
echo "2. Access the application at: https://aprs.me"
|
||||
echo "3. DNS points to 204.110.191.3 (Traefik ingress)"
|
||||
echo "3. DNS points to 204.110.191.2 (Traefik ingress)"
|
||||
|
|
|
|||
|
|
@ -43,6 +43,16 @@ spec:
|
|||
volumeMounts:
|
||||
- name: postgres-storage
|
||||
mountPath: /var/lib/postgresql/data
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
runAsGroup: 999
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
|
|
|
|||
|
|
@ -38,6 +38,16 @@ spec:
|
|||
limits:
|
||||
memory: "256Mi"
|
||||
cpu: "200m"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
runAsGroup: 999
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 6379
|
||||
|
|
|
|||
|
|
@ -1,29 +0,0 @@
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: graham@w5isp.com # Change this to your email
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: traefik
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: graham@w5isp.com # Change this to your email
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: traefik
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
#!/bin/bash
|
||||
# Check K3s cluster HA readiness
|
||||
|
||||
echo "=== K3s Cluster HA Readiness Check ==="
|
||||
echo ""
|
||||
|
||||
# Check nodes
|
||||
echo "1. Node Status:"
|
||||
kubectl get nodes -o wide
|
||||
echo ""
|
||||
|
||||
# Check LoadBalancer services
|
||||
echo "2. LoadBalancer Services (need to be accessible from any node):"
|
||||
kubectl get svc -A | grep LoadBalancer
|
||||
echo ""
|
||||
|
||||
# Check NodePort services
|
||||
echo "3. NodePort Services (can be accessed on any node):"
|
||||
kubectl get svc -A -o json | jq -r '.items[] | select(.spec.type=="NodePort") | "\(.metadata.namespace)/\(.metadata.name) - NodePorts: \(.spec.ports[].nodePort)"'
|
||||
echo ""
|
||||
|
||||
# Check Traefik/Ingress
|
||||
echo "4. Ingress Controller Status:"
|
||||
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik
|
||||
kubectl get svc -n kube-system traefik
|
||||
echo ""
|
||||
|
||||
# Check critical pods distribution
|
||||
echo "5. Critical Pod Distribution:"
|
||||
echo "Traefik pods:"
|
||||
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik -o wide
|
||||
|
||||
echo -e "\nAPRS pods:"
|
||||
kubectl get pods -n aprs -o wide
|
||||
|
||||
echo -e "\nAll pods on node1 (will be affected during update):"
|
||||
kubectl get pods -A -o wide | grep node1
|
||||
echo ""
|
||||
|
||||
# Recommendations
|
||||
echo "=== Recommendations ==="
|
||||
echo ""
|
||||
echo "For MikroTik failover, ensure:"
|
||||
echo "1. All services use NodePort or have hostPort configured"
|
||||
echo "2. Configure MikroTik NAT to forward to NodePort on all nodes"
|
||||
echo "3. Or use MikroTik Netwatch for automatic failover"
|
||||
echo ""
|
||||
echo "Current service ports:"
|
||||
kubectl get svc -A | grep -E "NodePort|LoadBalancer" | awk '{print $2 " (" $1 "): " $6}'
|
||||
550
home/cluster/controlplane.yaml
Normal file
550
home/cluster/controlplane.yaml
Normal file
|
|
@ -0,0 +1,550 @@
|
|||
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||
debug: false # Enable verbose logging to the console.
|
||||
persist: true
|
||||
# Provides machine specific configuration options.
|
||||
machine:
|
||||
type: controlplane # Defines the role of the machine within the cluster.
|
||||
token: l1ubxp.d942qc3plno7pxlw # The `token` is used by a machine to join the PKI of the cluster.
|
||||
# The root certificate authority of the PKI.
|
||||
ca:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSFNWZnhiOWpZWnVaQWVvUFlBYmVxSU1hK1RYT3o3bzZwaSt0cXY1Mk1mbgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||
# Extra certificate subject alternative names for the machine's certificate.
|
||||
certSANs: []
|
||||
# # Uncomment this to enable SANs.
|
||||
# - 10.0.0.10
|
||||
# - 172.16.0.10
|
||||
# - 192.168.0.10
|
||||
|
||||
# Used to provide additional options to the kubelet.
|
||||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.34.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
# - 10.96.0.10
|
||||
# - 169.254.2.53
|
||||
|
||||
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||
# extraMounts:
|
||||
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||
# type: bind # Type specifies the mount kind.
|
||||
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||
# # Options are fstab style mount options.
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
# serverTLSBootstrap: true
|
||||
|
||||
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||
# credentialProviderConfig:
|
||||
# apiVersion: kubelet.config.k8s.io/v1
|
||||
# kind: CredentialProviderConfig
|
||||
# providers:
|
||||
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||
# defaultCacheDuration: 12h
|
||||
# matchImages:
|
||||
# - '*.dkr.ecr.*.amazonaws.com'
|
||||
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||
# name: ecr-credential-provider
|
||||
|
||||
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||
# nodeIP:
|
||||
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||
# validSubnets:
|
||||
# - 10.0.0.0/8
|
||||
# - '!10.0.0.3/32'
|
||||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network: {}
|
||||
# # `interfaces` is used to define the network interface configuration.
|
||||
# interfaces:
|
||||
# - interface: enp0s1 # The interface name.
|
||||
# # Assigns static IP addresses to the interface.
|
||||
# addresses:
|
||||
# - 192.168.2.0/24
|
||||
# # A list of routes associated with the interface.
|
||||
# routes:
|
||||
# - network: 0.0.0.0/0 # The route's network (destination).
|
||||
# gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
|
||||
# metric: 1024 # The optional metric for the route.
|
||||
# mtu: 1500 # The interface's MTU.
|
||||
#
|
||||
# # # Picks a network device using the selector.
|
||||
|
||||
# # # select a device with bus prefix 00:*.
|
||||
# # deviceSelector:
|
||||
# # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
|
||||
# # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
|
||||
# # deviceSelector:
|
||||
# # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
|
||||
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
|
||||
# # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
|
||||
# # deviceSelector:
|
||||
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
|
||||
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
|
||||
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
|
||||
|
||||
# # # Bond specific options.
|
||||
# # bond:
|
||||
# # # The interfaces that make up the bond.
|
||||
# # interfaces:
|
||||
# # - enp2s0
|
||||
# # - enp2s1
|
||||
# # # Picks a network device using the selector.
|
||||
# # deviceSelectors:
|
||||
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
|
||||
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
|
||||
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
|
||||
# # mode: 802.3ad # A bond option.
|
||||
# # lacpRate: fast # A bond option.
|
||||
|
||||
# # # Bridge specific options.
|
||||
# # bridge:
|
||||
# # # The interfaces that make up the bridge.
|
||||
# # interfaces:
|
||||
# # - enxda4042ca9a51
|
||||
# # - enxae2a6774c259
|
||||
# # # Enable STP on this bridge.
|
||||
# # stp:
|
||||
# # enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
|
||||
|
||||
# # # Configure this device as a bridge port.
|
||||
# # bridgePort:
|
||||
# # master: br0 # The name of the bridge master interface
|
||||
|
||||
# # # Indicates if DHCP should be used to configure the interface.
|
||||
# # dhcp: true
|
||||
|
||||
# # # DHCP specific options.
|
||||
# # dhcpOptions:
|
||||
# # routeMetric: 1024 # The priority of all routes received via DHCP.
|
||||
|
||||
# # # Wireguard specific configuration.
|
||||
|
||||
# # # wireguard server example
|
||||
# # wireguard:
|
||||
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
|
||||
# # listenPort: 51111 # Specifies a device's listening port.
|
||||
# # # Specifies a list of peer configurations to apply to a device.
|
||||
# # peers:
|
||||
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
|
||||
# # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
|
||||
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
|
||||
# # allowedIPs:
|
||||
# # - 192.168.1.0/24
|
||||
# # # wireguard peer example
|
||||
# # wireguard:
|
||||
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
|
||||
# # # Specifies a list of peer configurations to apply to a device.
|
||||
# # peers:
|
||||
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
|
||||
# # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
|
||||
# # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
|
||||
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
|
||||
# # allowedIPs:
|
||||
# # - 192.168.1.0/24
|
||||
|
||||
# # # Virtual (shared) IP address configuration.
|
||||
|
||||
# # # layer2 vip example
|
||||
# # vip:
|
||||
# # ip: 172.16.199.55 # Specifies the IP address to be used.
|
||||
|
||||
# # Used to statically set the nameservers for the machine.
|
||||
# nameservers:
|
||||
# - 8.8.8.8
|
||||
# - 1.1.1.1
|
||||
|
||||
# # Used to statically set arbitrary search domains.
|
||||
# searchDomains:
|
||||
# - example.org
|
||||
# - example.com
|
||||
|
||||
# # Allows for extra entries to be added to the `/etc/hosts` file
|
||||
# extraHostEntries:
|
||||
# - ip: 192.168.1.100 # The IP of the host.
|
||||
# # The host alias.
|
||||
# aliases:
|
||||
# - example
|
||||
# - example.domain.tld
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
# enabled: true # Enable the KubeSpan feature.
|
||||
|
||||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/nvme0n1 # The disk used for installations.
|
||||
image: ghcr.io/siderolabs/installer:v1.11.1 # Allows for supplying the image used to perform the installation.
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
|
||||
# # Allows for supplying extra kernel args via the bootloader.
|
||||
# extraKernelArgs:
|
||||
# - talos.platform=metal
|
||||
# - reboot=k
|
||||
# Used to configure the machine's container image registry mirrors.
|
||||
registries: {}
|
||||
# # Specifies mirror configuration for each registry host namespace.
|
||||
# mirrors:
|
||||
# ghcr.io:
|
||||
# # List of endpoints (URLs) for registry mirrors to use.
|
||||
# endpoints:
|
||||
# - https://registry.insecure
|
||||
# - https://ghcr.io/v2/
|
||||
|
||||
# # Specifies TLS & auth configuration for HTTPS image registries.
|
||||
# config:
|
||||
# registry.insecure:
|
||||
# # The TLS configuration for the registry.
|
||||
# tls:
|
||||
# insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
|
||||
#
|
||||
# # # Enable mutual TLS authentication with the registry.
|
||||
# # clientIdentity:
|
||||
# # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||
# # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||
#
|
||||
# # # The auth configuration for this registry.
|
||||
# # auth:
|
||||
# # username: username # Optional registry authentication.
|
||||
# # password: password # Optional registry authentication.
|
||||
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
rbac: true # Enable role-based access control (RBAC).
|
||||
stableHostname: true # Enable stable default hostname.
|
||||
apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.
|
||||
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||
kubePrism:
|
||||
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||
port: 7445 # KubePrism port.
|
||||
# Configures host DNS caching resolver.
|
||||
hostDNS:
|
||||
enabled: true # Enable host DNS caching resolver.
|
||||
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||
|
||||
# # Configure Talos API access from Kubernetes pods.
|
||||
# kubernetesTalosAPIAccess:
|
||||
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||
# allowedRoles:
|
||||
# - os:reader
|
||||
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||
# allowedKubernetesNamespaces:
|
||||
# - kube-system
|
||||
# Configures the node labels for the machine.
|
||||
nodeLabels:
|
||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
||||
|
||||
# # Provides machine specific control plane configuration options.
|
||||
|
||||
# # ControlPlane definition example.
|
||||
# controlPlane:
|
||||
# # Controller manager machine specific configuration options.
|
||||
# controllerManager:
|
||||
# disabled: false # Disable kube-controller-manager on the node.
|
||||
# # Scheduler machine specific configuration options.
|
||||
# scheduler:
|
||||
# disabled: true # Disable kube-scheduler on the node.
|
||||
|
||||
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||
|
||||
# # nginx static pod.
|
||||
# pods:
|
||||
# - apiVersion: v1
|
||||
# kind: pod
|
||||
# metadata:
|
||||
# name: nginx
|
||||
# spec:
|
||||
# containers:
|
||||
# - image: nginx
|
||||
# name: nginx
|
||||
|
||||
# # Allows the addition of user specified files.
|
||||
|
||||
# # MachineFiles usage example.
|
||||
# files:
|
||||
# - content: '...' # The contents of the file.
|
||||
# permissions: 0o666 # The file's permissions in octal.
|
||||
# path: /tmp/file.txt # The path of the file.
|
||||
# op: append # The operation to use
|
||||
|
||||
# # The `env` field allows for the addition of environment variables.
|
||||
|
||||
# # Environment variables definition examples.
|
||||
# env:
|
||||
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||
# https_proxy: http://SERVER:PORT/
|
||||
# env:
|
||||
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||
# env:
|
||||
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||
|
||||
# # Used to configure the machine's time settings.
|
||||
|
||||
# # Example configuration for cloudflare ntp server.
|
||||
# time:
|
||||
# disabled: false # Indicates if the time service is disabled for the machine.
|
||||
# # description: |
|
||||
# servers:
|
||||
# - time.cloudflare.com
|
||||
# bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
|
||||
|
||||
# # Used to configure the machine's sysctls.
|
||||
|
||||
# # MachineSysctls usage example.
|
||||
# sysctls:
|
||||
# kernel.domainname: talos.dev
|
||||
# net.ipv4.ip_forward: "0"
|
||||
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||
|
||||
# # Used to configure the machine's sysfs.
|
||||
|
||||
# # MachineSysfs usage example.
|
||||
# sysfs:
|
||||
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||
|
||||
# # Configures the udev system.
|
||||
# udev:
|
||||
# # List of udev rules to apply to the udev system
|
||||
# rules:
|
||||
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||
|
||||
# # Configures the logging system.
|
||||
# logging:
|
||||
# # Logging destination.
|
||||
# destinations:
|
||||
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||
# format: json_lines # Logs format.
|
||||
|
||||
# # Configures the kernel.
|
||||
# kernel:
|
||||
# # Kernel modules to load.
|
||||
# modules:
|
||||
# - name: brtfs # Module name.
|
||||
|
||||
# # Configures the seccomp profiles for the machine.
|
||||
# seccompProfiles:
|
||||
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||
# # The `value` field is used to provide the seccomp profile.
|
||||
# value:
|
||||
# defaultAction: SCMP_ACT_LOG
|
||||
|
||||
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||
|
||||
# # override default open file limit
|
||||
# baseRuntimeSpecOverrides:
|
||||
# process:
|
||||
# rlimits:
|
||||
# - hard: 1024
|
||||
# soft: 1024
|
||||
# type: RLIMIT_NOFILE
|
||||
|
||||
# # Configures the node annotations for the machine.
|
||||
|
||||
# # node annotations example.
|
||||
# nodeAnnotations:
|
||||
# customer.io/rack: r13a25
|
||||
|
||||
# # Configures the node taints for the machine. Effect is optional.
|
||||
|
||||
# # node taints example.
|
||||
# nodeTaints:
|
||||
# exampleTaint: exampleTaintValue:NoSchedule
|
||||
# Provides cluster specific configuration options.
|
||||
cluster:
|
||||
id: eaZ-ULVPPORjVzp1Y4XpAOn4X8_UQTHwuGMLfNGZKgM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||
secret: 0CQQzq2WnliOSsobOhMsAARA77nM8Phz6XiADm+IfzI= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||
# Provides control plane specific configuration options.
|
||||
controlPlane:
|
||||
endpoint: https://10.0.101.21:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||
clusterName: home # Configures the cluster's name.
|
||||
# Provides cluster specific network configuration options.
|
||||
network:
|
||||
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||
# The pod subnet CIDR.
|
||||
podSubnets:
|
||||
- 10.244.0.0/16
|
||||
# The service subnet CIDR.
|
||||
serviceSubnets:
|
||||
- 10.96.0.0/12
|
||||
|
||||
# # The CNI used.
|
||||
# cni:
|
||||
# name: custom # Name of CNI to use.
|
||||
# # URLs containing manifests to apply for the CNI.
|
||||
# urls:
|
||||
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||
token: ehxond.kiubhs6w8x46jo2r # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||
secretboxEncryptionSecret: JqgvvHbtZe38JaE26u/q0XZMjAX0ilWNGywpYUh44RI= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||
# The base64 encoded root certificate authority used by Kubernetes.
|
||||
ca:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBlNFgzZjZEUjBMbU00dzI2TXZ6V2N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV3TVRneE5qQXhNVGhhRncwek5URXdNVFl4TmpBeApNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNIZWpBdWVwdjRXelpxTDkvSzNLdDdkSm1EaCtxWXI3Y2Q1QzB3S0J5RTYyZnRtRjg3TktJc3R1WU8KYkdWb1BjQ0QyVzU3YVVEdGl5dVVmWlJUdDczcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSXZuSlh1eVZVVWtFZVlxQy8rU2ZDUUwyQ2tpTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUVZcmRtSkYKaVVoM2xIaWlSSzJCamF6N3hyUjkvM2lDblZ2bm5meWlnbVNDQWlFQS9CSW9PWWJ2WmU5K2J0emo2b0tlaGRQcwo3R2Y3TTJYK0xhMlRQc3pMemswPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpWb29Icy9Lb3VEektMR0Q4Y0dHMTVIYVk2dGttTkJnUzNSWUtmYmV3ejlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaDNvd0xucWIrRnMyYWkvZnl0eXJlM1NaZzRmcW1LKzNIZVF0TUNnY2hPdG43WmhmT3pTaQpMTGJtRG14bGFEM0FnOWx1ZTJsQTdZc3JsSDJVVTdlOTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||
aggregatorCA:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYakNDQVFXZ0F3SUJBZ0lRWXZJOHVYbG5USDRqOURxeGh4YzdDekFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMU1UQXhPREUyTURFeE9Gb1hEVE0xTVRBeE5qRTJNREV4T0Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCRVFmUjVBWHBrNE1OSTk4ZlJQd3p4bmxVbkUwYTBCc2J6N1lDZjFCYzZYalh3OWxEckRICjJsTGt5RlhxK2FoTnZaUloyZWlZTkVQT2Jvak51WnV3R2JHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVhdnoza2JMaFFJNFdvRXVvcDdGUVk0QXdsTlF3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnCkg0b3BCbmppclN5R1pvTjBTbGtsRG96MlllUERtR09qSytXcmNsRmxnUDhDSUZLSmpSdXBFa3U2R1haNExneXIKQ3NMMWdXbkNzMklPS2FRbzlIOUhrb0NuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUs3MTlkZDZMZ0JidFFjZkdmNHZQVkVCWWFLWElseFM1enQ1NStZbFEzOTlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFUkI5SGtCZW1UZ3cwajN4OUUvRFBHZVZTY1RSclFHeHZQdGdKL1VGenBlTmZEMlVPc01mYQpVdVRJVmVyNXFFMjlsRm5aNkpnMFE4NXVpTTI1bTdBWnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
# The base64 encoded private key for service account token generation.
|
||||
serviceAccount:
|
||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBeTNXQnIxcFBpSTdHTkNuV05kelgxTWIvMkwwclNFVWZ6dEZUM3pzbnI3ZjZGbUV0CmJpVEt3ampOZG53NlNaR0dZamhob1ZuK1piNS9HS2dhem9jempNNjBDWHBpSG5ETnB1aGF0bnp0ZWVVZjJmQUoKMFJaTitoTWRJM3ZMcmhBUHlldWhxRXlYYlBFTm5rVmhvbkhrdGtxZCt5dXByNzJjd0p0bkxqZTcxRXJuOFlCZgpFQ1NtNDJiOFE2L2pWbGJjdkdFYzFkSWlGRG9iRkNDU0QrSzg4bklPckxWemU0YVRwZTdNU3NZUTVLb0JQdTJNCmJqNG85QjI5ajFvWVpJZjV6akgxdlNCb1AzejNKQ1kvOTJhSnFYaS9adHA5b1FWa2NCZjRqVjdSVVYrbklVWjIKOW8yVTU5OExnRWZjRFNXbEdlMDBOZkh6SzduSXN6Y1UwNjJsNmV1VVJLNitMcytWK1RIRG1xdHVJSHQzTm1pNQphdU5QZlEwYTRRQ0M3bHdTY0VITFpNVVdrd0oxR2QyQzg4Y0I0M1p5K2lnckhFenIwUHU3czNLcjFxTlBDN3gvCkpEY0M4T2UzY0p6MWp2K3RjZlZWYnQ0NVp2dHB0aUhkNkhTaDR4NmxvZTRGWUdFbE5JREJld2V3WkgrakM0RWQKdTZUdDg4WEpNbm5FMnYzR3FqVWloNExMUitqREdJcE5FN0tlNUc4a0dkK1ZXNUdRaHJVdWZIWlY2YjB0Zi81dgpETHJ6d0V2OCtUa1paT3h3Lyt5RDVXZ2RRYkQ5c3ZGQUJEdk9XOGhvTm1ySUg1Q2dKcmtOcERjWHRTcUR0UUJuCkNJWmxIUGpvT1F2djZZZEhhamFSTFZFR3A5M0EwR3VJR0Q0ZlJsS0U2SnlpNlpHTCtsWDdmK2owY0tNQ0F3RUEKQVFLQ0FnQVRpNzVoc2pOaDB4V0hmVjF1MzBCODJJRkx1U0NuV0x5dGliNmMrM25jajdnZTNrY1hCY0hVMXRBbQpTZGp2cUdOWW5FSUUxamh5WGRLbjg3NWZpTzJTNFdpNllGOTh2U21FbDEzZm1qRFdQUVRLVXgwZVVSNDhvQWwwCmx6Z0NDTmo3ZFArYXc0RG9ubC9JakxITWdWU1BqcXVPcmFzbmp2ZTRLVFhJWXVKUWlzR3RtYitJTlgweTYzbmcKcHMwWVJrLythUFgwTkxQQmJiT2NRMlRFMGV1RS95QVp4M1RJc1MwT0M5cmtkQks3WlBtcHFmaUx2cjBBZHJyMwpRcGlGVCtyWHZFVDNYbDJsZThQaVhTcFlBaW5IZGlvdEgyQmlUN3BPYW44ZVZiV1dNN0pDcUJwVnBWUmcwalN3CnBqYWxyTEFueFhuMmxML2Z1NEZrZGk0eUI4U2dnR2xsbGVxUnQyUG12QUl0S21ZeDVhL2w4cWJqYXRDZkJaeWwKcVROTkRxTnNoZHBKK1FaVGhsekdFVHdDSCs3aTd4MXZjYVdxV3I4dFZSbjZKdmg3S3krUHZvZVFEa3lDSUhSMgptN041VlBBS09QZnp5aFVZampIcnhlK1FlV0I3UTBMM3Ezdm4xMkxGbGZFeTh1UllxUm5UaU9DaytOMFB6WDJ3ClJvYUg1VG0yOW9IblRTRy92T1FWWEE5UmkzMmdFUGcyaFBleHR0Z1hKeDlWYXZIaHl3eDYvb0t3YitDbERkaHAKOTE0bHV2dkI4bk5BTHVIMWRvK244djhmeEYyVXJhL0ZOcklQNDlSdlZCK055VFFqbGkwNndEbHM4bW4wQTJocAowU0pZTW5HdGo1SDVxQXJDS20xcGY3Z1JJVm56M053YlVqME9HSm5ad1BPbWt6OW1nUUtDQVFFQTFsR2lha3BWCnNXd0gydWIxb3JIdU5iWmNOc1cxRW4rRzNTdXEzWmc0NkwvUmpXSHp1R1FuSWg1VGlER0tVTmNacG1zeE5pb1QKeTZHMmpmNThPZVdLVnNaa2tLYXlKT3BkNlE5a2l1Y1dzOERwYitsU2Z5L2VDdlg5VzBhcDArdEo0SjdGdEloWQpTdTFZT3NIRVVqSCthMGJmWnlVRFlWT2tENXRWTW43YnQyNlhQNXE4cEg3OTVQdUhCRkpQZHlaYllXcEc2U0V6CmZ6Q2N2NWh6SWo4NGV0T2lPWCsrdUNkcDhkQ284YWw4dnNEOTJ3Rk1DMzJYYmxiL0NtT2VmK1lieEVWOU1nVVUKeTZaaStMWHhMQzZYekE5RE1WMnUwV3ZDUVdUaXBDcmJXbHN4WUR0a3YwSUNZQnhSa2lmSEMxMzRSK0d5ckJiRgpDcEJlMXY0UkZ5eVkyd0tDQVFFQTh3Y3dIcmFMOGdXV1EwN0ZzN0xwNXJKa1ZvTTlaQUN1QzYyeUtHaFhDZWtaClNSMm9OcVdNM1dZMVZqV2dSazhha0pXckRtdmp1eURKNkxtcS9Db1M1a2h6Mm8xY3NGTWJ2UUdKOHhIWDZmVUcKWGFZa3Z2WHBGdzkwSlhCR1pYanVVS1BhcVQzS2VWTDdlTXI3TFkySzhNMkNNVGpqZHoyVDZ2bzhGeTM5ZnVEWgpYOTBiUU5FaUQxV2dldzRPU0lRWjNPdndXbU9lM0UzSGd0SmE0ZkVYaGhTbzg0dDhHTituYU9uMmdrOHJ5cjE0Ck9GVkcra3pkb21jQjNOQ1RJZFJkZS93NHk5SVFEMHBPb0M5SlN6MHJReGtBWXpKemt0MGVVaXRNUWpGU1NuS1EKblJxSUZLM0pZdng5QTVtSWNHOGU3R01mUEtZbTVrczA2c1BnWTVkTjJRS0NBUUVBMWpVcnJ5N3k3VzA3Z0tnOQpOTXJBZTBEMGMrNHhwL1o4ZGt5eDc5KzRhYkZuSWZlWUlHRkIxOUVWemxjdGx0VVhGd1dtWHl1NU0xdERXakxVCk9RM2FzaGFDNXkwbGVzNGc1Tk4wdTN4emJXQlFNWUd6NmRtUEJjZU4zaEFIcC85UWpNaEVkTWVkNysyL3RLSjgKdFdhd2tzcDRlZUE5dTZaY29SaXhFOUpGaXRabko3UmgvY3ZMdW5WSUlxS2VPRW5ISmR1U1dtckx6TUZxdWZrRwpnbUZMOHovWnNieWpnKzRvN3YrT0RGUkprV0xWbDNKNWJqYXVCeU8rcjhTWDQ5KzdPdlgxUnV4Yk41enE2UWo0CnJ4ODJxMGRKOG1wZlU0TnYyZXFhdUZqNWV4c1FnODE1U2N3UkViemNMc2ZCSXZSZU5vSTRFZGFFUktXOWxRYkYKVUROTDV3S0NBUUJrd2M4bWZLSnF0ZnhGYll3ejQzSnNEZnZoamtuT2d5V2xlOThJTjdJV1Rza0g4ajdDWVVLVQpyQUppK3BxM2E2WmsyVmh4QXpRSWFpQ3Ixd1pYdzQzUVlhdCtxZXNLdzNvVmsyVEJITjI2aHJhYjd2ei9HdThICmU0VzQyK0tqd1U1MHFtcEdqbks2ZURnQUxZK1RwRUk5Y2NhUFo3bU92ejNyUnRIUS9tVkJ6RER6T0xWSzJ5blcKMTdaUUxsU25wZlVmRGNhNWd1SGpEbkF3QWN4aUxsV0ZabDFoazZ2Z21DRk5NdXJidmIwM01mUjh6b1k5MGM1MQp2V1VkU25BbHIya090VlJLMUkySitWRzl3YjBPYjQ3WEk2OXdjUU5QbVZNdjEvbW0yOUgxUWFoSktpM08vUG9vCml1dTlxVkxTNG84Y2pEL3dJaWF3aGUrcmdZZ3ZZaFNKQW9JQkFRQ1doNkphNmwvNGovamJIVjRPOENxdWI3cUwKZ05iam1rU3Zua3JNYTRWS1l4ZWs0UWNsdVNzaUNOaFBjZVY3MGpQemdZQWNBV3ZNTVZTTG1uVFRGbU9XYlJ1MwpMeHZyMXBqc0Z4M2RlSHhKUFVZNGJub0Y0ZnZyclRKNVh4MHM2dzh1Z0ZNVWFGSno3THB2TFJhWEw0eHpjUTd1CmRTY2ZkRkw1aGZxVmZ3RDFQdXlFK2ZHb1ltb081Z21XblA1QW1GRERFa2dsTHlHOEhER3FERC9XYXNMbGdhZm8KZDVEejJPcm9HdGdzeElSajM5Q2ZZcm1jclllNDhXdXdSR2dJcmM4dURLZlR3a2RmTlpGTVdMcUlZdHM0Z1M0NwpQeFh2c3VoS1BhTWovaFhGanhzdWlROTFxdDRUbWw3TnFtNjM4cFEyeDFYb0lldmdRUXBTN2dVSW1vc1AKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
||||
# API server specific configuration options.
|
||||
apiServer:
|
||||
image: registry.k8s.io/kube-apiserver:v1.34.0 # The container image used in the API server manifest.
|
||||
# Extra certificate subject alternative names for the API server's certificate.
|
||||
certSANs:
|
||||
- 10.0.101.21
|
||||
disablePodSecurityPolicy: true # Disable PodSecurityPolicy in the API server and default manifests.
|
||||
# Configure the API server admission plugins.
|
||||
admissionControl:
|
||||
- name: PodSecurity # Name is the name of the admission controller.
|
||||
# Configuration is an embedded configuration object to be used as the plugin's
|
||||
configuration:
|
||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||
defaults:
|
||||
audit: restricted
|
||||
audit-version: latest
|
||||
enforce: baseline
|
||||
enforce-version: latest
|
||||
warn: restricted
|
||||
warn-version: latest
|
||||
exemptions:
|
||||
namespaces:
|
||||
- kube-system
|
||||
runtimeClasses: []
|
||||
usernames: []
|
||||
kind: PodSecurityConfiguration
|
||||
# Configure the API server audit policy.
|
||||
auditPolicy:
|
||||
apiVersion: audit.k8s.io/v1
|
||||
kind: Policy
|
||||
rules:
|
||||
- level: Metadata
|
||||
|
||||
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||
# authorizationConfig:
|
||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||
# name: webhook # Name is used to describe the authorizer.
|
||||
# # webhook is the configuration for the webhook authorizer.
|
||||
# webhook:
|
||||
# connectionInfo:
|
||||
# type: InClusterConfig
|
||||
# failurePolicy: Deny
|
||||
# matchConditionSubjectAccessReviewVersion: v1
|
||||
# matchConditions:
|
||||
# - expression: has(request.resourceAttributes)
|
||||
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||
# subjectAccessReviewVersion: v1
|
||||
# timeout: 3s
|
||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||
# # webhook is the configuration for the webhook authorizer.
|
||||
# webhook:
|
||||
# connectionInfo:
|
||||
# type: InClusterConfig
|
||||
# failurePolicy: NoOpinion
|
||||
# matchConditionSubjectAccessReviewVersion: v1
|
||||
# subjectAccessReviewVersion: v1
|
||||
# timeout: 3s
|
||||
# Controller manager server specific configuration options.
|
||||
controllerManager:
|
||||
image: registry.k8s.io/kube-controller-manager:v1.34.0 # The container image used in the controller manager manifest.
|
||||
# Kube-proxy server-specific configuration options
|
||||
proxy:
|
||||
image: registry.k8s.io/kube-proxy:v1.34.0 # The container image used in the kube-proxy manifest.
|
||||
|
||||
# # Disable kube-proxy deployment on cluster bootstrap.
|
||||
# disabled: false
|
||||
# Scheduler server specific configuration options.
|
||||
scheduler:
|
||||
image: registry.k8s.io/kube-scheduler:v1.34.0 # The container image used in the scheduler manifest.
|
||||
# Configures cluster member discovery.
|
||||
discovery:
|
||||
enabled: true # Enable the cluster membership discovery feature.
|
||||
# Configure registries used for cluster member discovery.
|
||||
registries:
|
||||
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||
kubernetes:
|
||||
disabled: true # Disable Kubernetes discovery registry.
|
||||
# Service registry is using an external service to push and pull information about cluster members.
|
||||
service: {}
|
||||
# # External service endpoint.
|
||||
# endpoint: https://discovery.talos.dev/
|
||||
# Etcd specific configuration options.
|
||||
etcd:
|
||||
# The `ca` is the root certificate authority of the PKI.
|
||||
ca:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmekNDQVNTZ0F3SUJBZ0lSQVBPYnhxSEJhTEcrRWlEblFYbFF1amt3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TlRFd01UZ3hOakF4TVRoYUZ3MHpOVEV3TVRZeE5qQXhNVGhhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFUcG43ZDFHMjdJCk9lZzJLQ3E3bzhQWFV0Vm1yY0tSQkFMc2c2OXZoczdFZUU2aEkzSUdPcTNYcWpTdVAxbGJicVVlZWlNNTRDU1kKYXNTK0tvaUtjUmlubzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpKZUhoZ0xsRWxxCno0L0l6WG51bGtUTU5hQVJNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUNJUURwZ1BRdTlpWDdoU05JbFJKek9JNDEKZ2pjZXNLQmo2T2d6dFE2M0dGa2ZuQUloQU9NaS9RYTRYc2FwOVFxSXJvd0tUaU9mZ25IS1YxeUZDVExqS29lRQpSTTdYCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtPNi9KcjFrT2l0a08wbVllTnB6L3d5QjNmYUVWUWN2RmZETndXUHIxZGRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFNlorM2RSdHV5RG5vTmlncXU2UEQxMUxWWnEzQ2tRUUM3SU92YjRiT3hIaE9vU055QmpxdAoxNm8wcmo5WlcyNmxIbm9qT2VBa21HckV2aXFJaW5FWXB3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
|
||||
# # The container image used to create the etcd service.
|
||||
# image: gcr.io/etcd-development/etcd:v3.6.4
|
||||
|
||||
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||
# advertisedSubnets:
|
||||
# - 10.0.0.0/8
|
||||
# A list of urls that point to additional manifests.
|
||||
extraManifests: []
|
||||
# - https://www.example.com/manifest1.yaml
|
||||
# - https://www.example.com/manifest2.yaml
|
||||
|
||||
# A list of inline Kubernetes manifests.
|
||||
inlineManifests: []
|
||||
# - name: namespace-ci # Name of the manifest.
|
||||
# contents: |- # Manifest contents as a string.
|
||||
# apiVersion: v1
|
||||
# kind: Namespace
|
||||
# metadata:
|
||||
# name: ci
|
||||
|
||||
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||
|
||||
# # Decryption secret example (do not use in production!).
|
||||
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||
|
||||
# # Core DNS specific configuration options.
|
||||
# coreDNS:
|
||||
# image: registry.k8s.io/coredns/coredns:v1.12.3 # The `image` field is an override to the default coredns image.
|
||||
|
||||
# # External cloud provider configuration.
|
||||
# externalCloudProvider:
|
||||
# enabled: true # Enable external cloud provider.
|
||||
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||
# manifests:
|
||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||
|
||||
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||
# extraManifestHeaders:
|
||||
# Token: "1234567"
|
||||
# X-ExtraInfo: info
|
||||
|
||||
# # Settings for admin kubeconfig generation.
|
||||
# adminKubeconfig:
|
||||
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||
|
||||
# # Allows running workload on control-plane nodes.
|
||||
allowSchedulingOnControlPlanes: true
|
||||
140
home/cluster/deploy.md
Normal file
140
home/cluster/deploy.md
Normal file
|
|
@ -0,0 +1,140 @@
|
|||
# Cluster Deployment Guide
|
||||
|
||||
This document tracks the commands and process for provisioning the k3s cluster with Talos.
|
||||
|
||||
## Initial Talos Setup
|
||||
|
||||
Fresh Talos cluster has been set up. Document deployment commands below as they are executed.
|
||||
|
||||
## Deployment Commands Log
|
||||
|
||||
### Attempted APRS Deployment
|
||||
|
||||
```bash
|
||||
# Attempted to deploy APRS application
|
||||
cd /Users/graham/dev/infra/home/cluster/aprs
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" ./deploy.sh
|
||||
```
|
||||
|
||||
**Issue**: Kubernetes API at 10.0.101.21:6443 not accessible - connection timeout.
|
||||
**Current Context**: admin@home
|
||||
**Status**: Deployment blocked - need cluster connectivity
|
||||
|
||||
### Network Configuration Fix
|
||||
|
||||
```bash
|
||||
# Fixed node1.patch.yaml to remove conflicting default route from VLAN 10
|
||||
# VLAN 10 now only has IP assignment, main interface handles routing
|
||||
```
|
||||
|
||||
**Issue**: Dual default routes caused connectivity loss
|
||||
**Fix**: Removed default route from VLAN 9 configuration to prevent dual route conflicts
|
||||
|
||||
### Security Context Fixes for PodSecurity Policy
|
||||
|
||||
```bash
|
||||
# Fixed PostgreSQL deployment security context
|
||||
kubectl apply -f postgres-deployment.yaml
|
||||
|
||||
# Fixed Redis deployment security context
|
||||
kubectl apply -f redis.yaml
|
||||
|
||||
# Fixed APRS StatefulSet security context (migrate + aprs containers)
|
||||
kubectl apply -f aprs-statefulset-with-pullsecret.yaml
|
||||
```
|
||||
|
||||
### Node1 Public IP Configuration
|
||||
|
||||
```bash
|
||||
# Updated node1.patch.yaml with public IP 204.110.191.2/27
|
||||
# Gateway: 204.110.191.30 on VLAN 9
|
||||
# Applied node1 configuration with public IP
|
||||
talosctl apply-config --talosconfig=./talosconfig -e 10.0.101.21 --nodes 10.0.101.21 --file controlplane.yaml --config-patch @node1.patch.yaml --config-patch @tailscale.patch.yaml
|
||||
```
|
||||
|
||||
### Cert-Manager Deployment
|
||||
|
||||
```bash
|
||||
# Check if cert-manager is installed
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl get pods -n cert-manager
|
||||
|
||||
# Install cert-manager v1.16.1
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml
|
||||
|
||||
# Wait for cert-manager to be ready
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=cert-manager -n cert-manager --timeout=300s
|
||||
|
||||
# Deploy Let's Encrypt ClusterIssuer (had webhook timeout issues)
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl delete validatingwebhookconfiguration cert-manager-webhook
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f cert-manager/letsencrypt-prod.yaml
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml
|
||||
```
|
||||
|
||||
### Traefik Deployment
|
||||
|
||||
```bash
|
||||
# Create traefik namespace
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl create namespace traefik-system
|
||||
|
||||
# Install Traefik via Helm with LoadBalancer
|
||||
helm repo update
|
||||
helm install traefik traefik/traefik --namespace traefik-system --set service.type=LoadBalancer
|
||||
|
||||
# Wait for Traefik to be ready
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=traefik -n traefik-system --timeout=300s
|
||||
|
||||
# Deploy APRS IngressRoute and Certificate (temporarily removed webhook)
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl delete validatingwebhookconfiguration cert-manager-webhook
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f aprs/aprs-ingressroute.yaml
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.yaml
|
||||
```
|
||||
|
||||
### Longhorn Storage Deployment
|
||||
|
||||
```bash
|
||||
# Install Longhorn v1.7.1
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.7.1/deploy/longhorn.yaml
|
||||
|
||||
# Set privileged security policy for Longhorn namespace (required for hostPath volumes)
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl label namespace longhorn-system pod-security.kubernetes.io/enforce=privileged
|
||||
|
||||
# Restart DaemonSet to apply new security policy
|
||||
PATH="/Users/graham/google-cloud-sdk/bin:$PATH" kubectl rollout restart ds/longhorn-manager -n longhorn-system
|
||||
|
||||
# Note: Longhorn may take several minutes to fully initialize and create storage class
|
||||
```
|
||||
|
||||
### DNS Configuration Update
|
||||
|
||||
```bash
|
||||
# Updated aprs.me DNS records to point to new cluster IP
|
||||
# File: home/terraform/dns_aprs_me_cloudflare.tf
|
||||
# Changed from 204.110.191.3 to 204.110.191.2
|
||||
|
||||
# Verify DNS changes (records already applied correctly)
|
||||
tofu -chdir=/Users/graham/dev/infra/home/terraform plan -target=cloudflare_record.aprs_me_root -target=cloudflare_record.aprs_me_www
|
||||
tofu -chdir=/Users/graham/dev/infra/home/terraform state show cloudflare_record.aprs_me_root
|
||||
|
||||
# Confirmed: Both aprs.me and www.aprs.me point to 204.110.191.2
|
||||
```
|
||||
|
||||
## Key Configuration Files
|
||||
|
||||
- `controlplane.yaml` - Talos control plane configuration
|
||||
- `worker.yaml` - Talos worker node configuration
|
||||
- `node1.patch.yaml`, `node2.patch.yaml`, `node3.patch.yaml` - Node-specific patches
|
||||
- `talosconfig` - Talos client configuration
|
||||
|
||||
## Notes
|
||||
|
||||
- Cluster uses Talos Linux as the operating system
|
||||
- Applications deployed via kubectl with manifests in subdirectories
|
||||
- Each application has its own deploy.sh script for easy deployment
|
||||
|
||||
## Reproduction Steps
|
||||
|
||||
1. Apply Talos configurations to nodes
|
||||
2. Bootstrap cluster
|
||||
3. Deploy applications as needed
|
||||
|
||||
_Detailed steps will be added as deployment progresses._
|
||||
29
home/cluster/node1.patch.yaml
Normal file
29
home/cluster/node1.patch.yaml
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
machine:
|
||||
# Static IP Configuration
|
||||
network:
|
||||
hostname: node1.w5isp.com
|
||||
interfaces:
|
||||
- deviceSelector:
|
||||
physical: true
|
||||
addresses:
|
||||
- 10.0.101.21/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.0.101.254
|
||||
dhcp: false
|
||||
vlans:
|
||||
- addresses:
|
||||
- 204.110.191.2/27
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 204.110.191.30
|
||||
vlanId: 9
|
||||
kubelet:
|
||||
extraMounts:
|
||||
- destination: /var/lib/longhorn
|
||||
type: bind
|
||||
source: /var/lib/longhorn
|
||||
options:
|
||||
- bind
|
||||
- rshared
|
||||
- rw
|
||||
22
home/cluster/node2.patch.yaml
Normal file
22
home/cluster/node2.patch.yaml
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
machine:
|
||||
# Static IP Configuration
|
||||
network:
|
||||
hostname: node2.w5isp.com
|
||||
interfaces:
|
||||
- deviceSelector:
|
||||
physical: true
|
||||
addresses:
|
||||
- 10.0.101.22/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.0.101.254
|
||||
dhcp: false
|
||||
kubelet:
|
||||
extraMounts:
|
||||
- destination: /var/lib/longhorn
|
||||
type: bind
|
||||
source: /var/lib/longhorn
|
||||
options:
|
||||
- bind
|
||||
- rshared
|
||||
- rw
|
||||
22
home/cluster/node3.patch.yaml
Normal file
22
home/cluster/node3.patch.yaml
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
machine:
|
||||
# Static IP Configuration
|
||||
network:
|
||||
hostname: node3.w5isp.com
|
||||
interfaces:
|
||||
- deviceSelector:
|
||||
physical: true
|
||||
addresses:
|
||||
- 10.0.101.23/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.0.101.254
|
||||
dhcp: false
|
||||
kubelet:
|
||||
extraMounts:
|
||||
- destination: /var/lib/longhorn
|
||||
type: bind
|
||||
source: /var/lib/longhorn
|
||||
options:
|
||||
- bind
|
||||
- rshared
|
||||
- rw
|
||||
8
home/cluster/schematic.yaml
Normal file
8
home/cluster/schematic.yaml
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
customization:
|
||||
systemExtensions:
|
||||
officialExtensions:
|
||||
- siderolabs/iscsi-tools
|
||||
- siderolabs/qemu-guest-agent
|
||||
- siderolabs/tailscale
|
||||
- siderolabs/util-linux-tools
|
||||
|
||||
5
home/cluster/tailscale.patch.yaml
Normal file
5
home/cluster/tailscale.patch.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: v1alpha1
|
||||
kind: ExtensionServiceConfig
|
||||
name: tailscale
|
||||
environment:
|
||||
- TS_AUTHKEY=tskey-auth-kQWvbQQPDQ11CNTRL-xzEZ6vSwfH22zJcVAHsFH2NemetVQ53Bg
|
||||
7
home/cluster/talosconfig
Normal file
7
home/cluster/talosconfig
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
context: home
|
||||
contexts:
|
||||
home:
|
||||
endpoints: []
|
||||
ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLVENCM0tBREFnRUNBaEVBZ1VTcEExTk1IYnhBNmxLVXVXVC9FVEFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTWpZeE1ERTRNVFl3TVRFNFdqQVRNUkV3RHdZRApWUVFLRXdodmN6cGhaRzFwYmpBcU1BVUdBeXRsY0FNaEFPWDI2YXhRYWMyNkhmbmtpOEZSTnNUeWZMU1FQSWFhCkphSW1SRlY4aVQwT28wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0I0QXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUgKQXdJd0h3WURWUjBqQkJnd0ZvQVVralc5TkJ1UUkySTBTQTFaRk0xa05LYVRMNW93QlFZREsyVndBMEVBa25hTQpJVTFTNjE1eS9HWkFRb3VFcmQxcUdmaDkyd2IrTDR4NGxTc09Fa1VjdTBXM1EzN3RWbElsZlFnbDRaK3ZzV2IxCnhNSWhrWVFVNUFRRW5rb1VEdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJUHlOTHBLZmJqZm9DbGVlRUhpYjlCUUZYdlNhVndjWEtYMjhHOHFMNWt3OQotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||
580
home/cluster/worker.yaml
Normal file
580
home/cluster/worker.yaml
Normal file
|
|
@ -0,0 +1,580 @@
|
|||
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||
debug: false # Enable verbose logging to the console.
|
||||
persist: true
|
||||
# Provides machine specific configuration options.
|
||||
machine:
|
||||
type: worker # Defines the role of the machine within the cluster.
|
||||
token: l1ubxp.d942qc3plno7pxlw # The `token` is used by a machine to join the PKI of the cluster.
|
||||
# The root certificate authority of the PKI.
|
||||
ca:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBeDJXVXNUbWJHZWtza1ZaOW1iQk12ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNREU0TVRZd01URTRXaGNOTXpVeE1ERTJNVFl3TVRFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBVM3drcTNqdlpkaHJUYk9zRW8vTFFUMjYwdm9MNDZlZUsyCjJnNVdKMnNqbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkpJMXZUUWJrQ05pTkVnTgpXUlROWkRTbWt5K2FNQVVHQXl0bGNBTkJBQU5OcEltVGxyMi9qMXllRlpLQWZSTXN0aHVoQTV3QjNDOU1TOWs4CmtyOVdZaHlORVVLY1Q4a0V4Q3BsZkU1b3ZtRTVLOWhIdEtOOXRpYzBRWk82RHdBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: ""
|
||||
# Extra certificate subject alternative names for the machine's certificate.
|
||||
certSANs: []
|
||||
# # Uncomment this to enable SANs.
|
||||
# - 10.0.0.10
|
||||
# - 172.16.0.10
|
||||
# - 192.168.0.10
|
||||
|
||||
# Used to provide additional options to the kubelet.
|
||||
kubelet:
|
||||
image: ghcr.io/siderolabs/kubelet:v1.34.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||
|
||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||
# clusterDNS:
|
||||
# - 10.96.0.10
|
||||
# - 169.254.2.53
|
||||
|
||||
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||
# extraArgs:
|
||||
# key: value
|
||||
|
||||
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||
# extraMounts:
|
||||
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||
# type: bind # Type specifies the mount kind.
|
||||
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||
# # Options are fstab style mount options.
|
||||
# options:
|
||||
# - bind
|
||||
# - rshared
|
||||
# - rw
|
||||
|
||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||
# extraConfig:
|
||||
# serverTLSBootstrap: true
|
||||
|
||||
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||
# credentialProviderConfig:
|
||||
# apiVersion: kubelet.config.k8s.io/v1
|
||||
# kind: CredentialProviderConfig
|
||||
# providers:
|
||||
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||
# defaultCacheDuration: 12h
|
||||
# matchImages:
|
||||
# - '*.dkr.ecr.*.amazonaws.com'
|
||||
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||
# name: ecr-credential-provider
|
||||
|
||||
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||
# nodeIP:
|
||||
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||
# validSubnets:
|
||||
# - 10.0.0.0/8
|
||||
# - '!10.0.0.3/32'
|
||||
# - fdc7::/16
|
||||
# Provides machine specific network configuration options.
|
||||
network: {}
|
||||
# # `interfaces` is used to define the network interface configuration.
|
||||
# interfaces:
|
||||
# - interface: enp0s1 # The interface name.
|
||||
# # Assigns static IP addresses to the interface.
|
||||
# addresses:
|
||||
# - 192.168.2.0/24
|
||||
# # A list of routes associated with the interface.
|
||||
# routes:
|
||||
# - network: 0.0.0.0/0 # The route's network (destination).
|
||||
# gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
|
||||
# metric: 1024 # The optional metric for the route.
|
||||
# mtu: 1500 # The interface's MTU.
|
||||
#
|
||||
# # # Picks a network device using the selector.
|
||||
|
||||
# # # select a device with bus prefix 00:*.
|
||||
# # deviceSelector:
|
||||
# # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
|
||||
# # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
|
||||
# # deviceSelector:
|
||||
# # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
|
||||
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
|
||||
# # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
|
||||
# # deviceSelector:
|
||||
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
|
||||
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
|
||||
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
|
||||
|
||||
# # # Bond specific options.
|
||||
# # bond:
|
||||
# # # The interfaces that make up the bond.
|
||||
# # interfaces:
|
||||
# # - enp2s0
|
||||
# # - enp2s1
|
||||
# # # Picks a network device using the selector.
|
||||
# # deviceSelectors:
|
||||
# # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
|
||||
# # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.
|
||||
# # driver: virtio_net # Kernel driver, supports matching by wildcard.
|
||||
# # mode: 802.3ad # A bond option.
|
||||
# # lacpRate: fast # A bond option.
|
||||
|
||||
# # # Bridge specific options.
|
||||
# # bridge:
|
||||
# # # The interfaces that make up the bridge.
|
||||
# # interfaces:
|
||||
# # - enxda4042ca9a51
|
||||
# # - enxae2a6774c259
|
||||
# # # Enable STP on this bridge.
|
||||
# # stp:
|
||||
# # enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
|
||||
|
||||
# # # Configure this device as a bridge port.
|
||||
# # bridgePort:
|
||||
# # master: br0 # The name of the bridge master interface
|
||||
|
||||
# # # Indicates if DHCP should be used to configure the interface.
|
||||
# # dhcp: true
|
||||
|
||||
# # # DHCP specific options.
|
||||
# # dhcpOptions:
|
||||
# # routeMetric: 1024 # The priority of all routes received via DHCP.
|
||||
|
||||
# # # Wireguard specific configuration.
|
||||
|
||||
# # # wireguard server example
|
||||
# # wireguard:
|
||||
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
|
||||
# # listenPort: 51111 # Specifies a device's listening port.
|
||||
# # # Specifies a list of peer configurations to apply to a device.
|
||||
# # peers:
|
||||
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
|
||||
# # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
|
||||
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
|
||||
# # allowedIPs:
|
||||
# # - 192.168.1.0/24
|
||||
# # # wireguard peer example
|
||||
# # wireguard:
|
||||
# # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
|
||||
# # # Specifies a list of peer configurations to apply to a device.
|
||||
# # peers:
|
||||
# # - publicKey: ABCDEF... # Specifies the public key of this peer.
|
||||
# # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
|
||||
# # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
|
||||
# # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
|
||||
# # allowedIPs:
|
||||
# # - 192.168.1.0/24
|
||||
|
||||
# # # Virtual (shared) IP address configuration.
|
||||
|
||||
# # # layer2 vip example
|
||||
# # vip:
|
||||
# # ip: 172.16.199.55 # Specifies the IP address to be used.
|
||||
|
||||
# # Used to statically set the nameservers for the machine.
|
||||
# nameservers:
|
||||
# - 8.8.8.8
|
||||
# - 1.1.1.1
|
||||
|
||||
# # Used to statically set arbitrary search domains.
|
||||
# searchDomains:
|
||||
# - example.org
|
||||
# - example.com
|
||||
|
||||
# # Allows for extra entries to be added to the `/etc/hosts` file
|
||||
# extraHostEntries:
|
||||
# - ip: 192.168.1.100 # The IP of the host.
|
||||
# # The host alias.
|
||||
# aliases:
|
||||
# - example
|
||||
# - example.domain.tld
|
||||
|
||||
# # Configures KubeSpan feature.
|
||||
# kubespan:
|
||||
# enabled: true # Enable the KubeSpan feature.
|
||||
|
||||
# Used to provide instructions for installations.
|
||||
install:
|
||||
disk: /dev/nvme0n1 # The disk used for installations.
|
||||
image: ghcr.io/siderolabs/installer:v1.11.1 # Allows for supplying the image used to perform the installation.
|
||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||
|
||||
# # Look up disk using disk attributes like model, size, serial and others.
|
||||
# diskSelector:
|
||||
# size: 4GB # Disk size.
|
||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||
|
||||
# # Allows for supplying extra kernel args via the bootloader.
|
||||
# extraKernelArgs:
|
||||
# - talos.platform=metal
|
||||
# - reboot=k
|
||||
# Used to configure the machine's container image registry mirrors.
|
||||
registries: {}
|
||||
# # Specifies mirror configuration for each registry host namespace.
|
||||
# mirrors:
|
||||
# ghcr.io:
|
||||
# # List of endpoints (URLs) for registry mirrors to use.
|
||||
# endpoints:
|
||||
# - https://registry.insecure
|
||||
# - https://ghcr.io/v2/
|
||||
|
||||
# # Specifies TLS & auth configuration for HTTPS image registries.
|
||||
# config:
|
||||
# registry.insecure:
|
||||
# # The TLS configuration for the registry.
|
||||
# tls:
|
||||
# insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
|
||||
#
|
||||
# # # Enable mutual TLS authentication with the registry.
|
||||
# # clientIdentity:
|
||||
# # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||
# # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||
#
|
||||
# # # The auth configuration for this registry.
|
||||
# # auth:
|
||||
# # username: username # Optional registry authentication.
|
||||
# # password: password # Optional registry authentication.
|
||||
|
||||
# Features describe individual Talos features that can be switched on or off.
|
||||
features:
|
||||
rbac: true # Enable role-based access control (RBAC).
|
||||
stableHostname: true # Enable stable default hostname.
|
||||
apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.
|
||||
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||
kubePrism:
|
||||
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||
port: 7445 # KubePrism port.
|
||||
# Configures host DNS caching resolver.
|
||||
hostDNS:
|
||||
enabled: true # Enable host DNS caching resolver.
|
||||
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||
|
||||
# # Configure Talos API access from Kubernetes pods.
|
||||
# kubernetesTalosAPIAccess:
|
||||
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||
# allowedRoles:
|
||||
# - os:reader
|
||||
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||
# allowedKubernetesNamespaces:
|
||||
# - kube-system
|
||||
|
||||
# # Provides machine specific control plane configuration options.
|
||||
|
||||
# # ControlPlane definition example.
|
||||
# controlPlane:
|
||||
# # Controller manager machine specific configuration options.
|
||||
# controllerManager:
|
||||
# disabled: false # Disable kube-controller-manager on the node.
|
||||
# # Scheduler machine specific configuration options.
|
||||
# scheduler:
|
||||
# disabled: true # Disable kube-scheduler on the node.
|
||||
|
||||
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||
|
||||
# # nginx static pod.
|
||||
# pods:
|
||||
# - apiVersion: v1
|
||||
# kind: pod
|
||||
# metadata:
|
||||
# name: nginx
|
||||
# spec:
|
||||
# containers:
|
||||
# - image: nginx
|
||||
# name: nginx
|
||||
|
||||
# # Allows the addition of user specified files.
|
||||
|
||||
# # MachineFiles usage example.
|
||||
# files:
|
||||
# - content: '...' # The contents of the file.
|
||||
# permissions: 0o666 # The file's permissions in octal.
|
||||
# path: /tmp/file.txt # The path of the file.
|
||||
# op: append # The operation to use
|
||||
|
||||
# # The `env` field allows for the addition of environment variables.
|
||||
|
||||
# # Environment variables definition examples.
|
||||
# env:
|
||||
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||
# https_proxy: http://SERVER:PORT/
|
||||
# env:
|
||||
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||
# env:
|
||||
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||
|
||||
# # Used to configure the machine's time settings.
|
||||
|
||||
# # Example configuration for cloudflare ntp server.
|
||||
# time:
|
||||
# disabled: false # Indicates if the time service is disabled for the machine.
|
||||
# # description: |
|
||||
# servers:
|
||||
# - time.cloudflare.com
|
||||
# bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
|
||||
|
||||
# # Used to configure the machine's sysctls.
|
||||
|
||||
# # MachineSysctls usage example.
|
||||
# sysctls:
|
||||
# kernel.domainname: talos.dev
|
||||
# net.ipv4.ip_forward: "0"
|
||||
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||
|
||||
# # Used to configure the machine's sysfs.
|
||||
|
||||
# # MachineSysfs usage example.
|
||||
# sysfs:
|
||||
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||
|
||||
# # Configures the udev system.
|
||||
# udev:
|
||||
# # List of udev rules to apply to the udev system
|
||||
# rules:
|
||||
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||
|
||||
# # Configures the logging system.
|
||||
# logging:
|
||||
# # Logging destination.
|
||||
# destinations:
|
||||
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||
# format: json_lines # Logs format.
|
||||
|
||||
# # Configures the kernel.
|
||||
# kernel:
|
||||
# # Kernel modules to load.
|
||||
# modules:
|
||||
# - name: brtfs # Module name.
|
||||
|
||||
# # Configures the seccomp profiles for the machine.
|
||||
# seccompProfiles:
|
||||
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||
# # The `value` field is used to provide the seccomp profile.
|
||||
# value:
|
||||
# defaultAction: SCMP_ACT_LOG
|
||||
|
||||
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||
|
||||
# # override default open file limit
|
||||
# baseRuntimeSpecOverrides:
|
||||
# process:
|
||||
# rlimits:
|
||||
# - hard: 1024
|
||||
# soft: 1024
|
||||
# type: RLIMIT_NOFILE
|
||||
|
||||
# # Configures the node labels for the machine.
|
||||
|
||||
# # node labels example.
|
||||
# nodeLabels:
|
||||
# exampleLabel: exampleLabelValue
|
||||
|
||||
# # Configures the node annotations for the machine.
|
||||
|
||||
# # node annotations example.
|
||||
# nodeAnnotations:
|
||||
# customer.io/rack: r13a25
|
||||
|
||||
# # Configures the node taints for the machine. Effect is optional.
|
||||
|
||||
# # node taints example.
|
||||
# nodeTaints:
|
||||
# exampleTaint: exampleTaintValue:NoSchedule
|
||||
# Provides cluster specific configuration options.
|
||||
cluster:
|
||||
id: eaZ-ULVPPORjVzp1Y4XpAOn4X8_UQTHwuGMLfNGZKgM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||
secret: 0CQQzq2WnliOSsobOhMsAARA77nM8Phz6XiADm+IfzI= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||
# Provides control plane specific configuration options.
|
||||
controlPlane:
|
||||
endpoint: https://10.0.101.21:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||
clusterName: home # Configures the cluster's name.
|
||||
# Provides cluster specific network configuration options.
|
||||
network:
|
||||
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||
# The pod subnet CIDR.
|
||||
podSubnets:
|
||||
- 10.244.0.0/16
|
||||
# The service subnet CIDR.
|
||||
serviceSubnets:
|
||||
- 10.96.0.0/12
|
||||
|
||||
# # The CNI used.
|
||||
# cni:
|
||||
# name: custom # Name of CNI to use.
|
||||
# # URLs containing manifests to apply for the CNI.
|
||||
# urls:
|
||||
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||
token: ehxond.kiubhs6w8x46jo2r # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||
# The base64 encoded root certificate authority used by Kubernetes.
|
||||
ca:
|
||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBlNFgzZjZEUjBMbU00dzI2TXZ6V2N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV3TVRneE5qQXhNVGhhRncwek5URXdNVFl4TmpBeApNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNIZWpBdWVwdjRXelpxTDkvSzNLdDdkSm1EaCtxWXI3Y2Q1QzB3S0J5RTYyZnRtRjg3TktJc3R1WU8KYkdWb1BjQ0QyVzU3YVVEdGl5dVVmWlJUdDczcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSXZuSlh1eVZVVWtFZVlxQy8rU2ZDUUwyQ2tpTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUVZcmRtSkYKaVVoM2xIaWlSSzJCamF6N3hyUjkvM2lDblZ2bm5meWlnbVNDQWlFQS9CSW9PWWJ2WmU5K2J0emo2b0tlaGRQcwo3R2Y3TTJYK0xhMlRQc3pMemswPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
key: ""
|
||||
# Configures cluster member discovery.
|
||||
discovery:
|
||||
enabled: true # Enable the cluster membership discovery feature.
|
||||
# Configure registries used for cluster member discovery.
|
||||
registries:
|
||||
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||
kubernetes:
|
||||
disabled: true # Disable Kubernetes discovery registry.
|
||||
# Service registry is using an external service to push and pull information about cluster members.
|
||||
service: {}
|
||||
# # External service endpoint.
|
||||
# endpoint: https://discovery.talos.dev/
|
||||
|
||||
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||
|
||||
# # Decryption secret example (do not use in production!).
|
||||
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||
|
||||
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||
|
||||
# # Decryption secret example (do not use in production!).
|
||||
# secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||
|
||||
# # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||
|
||||
# # AggregatorCA example.
|
||||
# aggregatorCA:
|
||||
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||
|
||||
# # The base64 encoded private key for service account token generation.
|
||||
|
||||
# # AggregatorCA example.
|
||||
# serviceAccount:
|
||||
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||
|
||||
# # API server specific configuration options.
|
||||
# apiServer:
|
||||
# image: registry.k8s.io/kube-apiserver:v1.34.0 # The container image used in the API server manifest.
|
||||
# # Extra arguments to supply to the API server.
|
||||
# extraArgs:
|
||||
# feature-gates: ServerSideApply=true
|
||||
# http2-max-streams-per-connection: "32"
|
||||
# # Extra certificate subject alternative names for the API server's certificate.
|
||||
# certSANs:
|
||||
# - 1.2.3.4
|
||||
# - 4.5.6.7
|
||||
# # Configure the API server admission plugins.
|
||||
# admissionControl:
|
||||
# - name: PodSecurity # Name is the name of the admission controller.
|
||||
# # Configuration is an embedded configuration object to be used as the plugin's
|
||||
# configuration:
|
||||
# apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||
# defaults:
|
||||
# audit: restricted
|
||||
# audit-version: latest
|
||||
# enforce: baseline
|
||||
# enforce-version: latest
|
||||
# warn: restricted
|
||||
# warn-version: latest
|
||||
# exemptions:
|
||||
# namespaces:
|
||||
# - kube-system
|
||||
# runtimeClasses: []
|
||||
# usernames: []
|
||||
# kind: PodSecurityConfiguration
|
||||
# # Configure the API server audit policy.
|
||||
# auditPolicy:
|
||||
# apiVersion: audit.k8s.io/v1
|
||||
# kind: Policy
|
||||
# rules:
|
||||
# - level: Metadata
|
||||
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||
# authorizationConfig:
|
||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||
# name: webhook # Name is used to describe the authorizer.
|
||||
# # webhook is the configuration for the webhook authorizer.
|
||||
# webhook:
|
||||
# connectionInfo:
|
||||
# type: InClusterConfig
|
||||
# failurePolicy: Deny
|
||||
# matchConditionSubjectAccessReviewVersion: v1
|
||||
# matchConditions:
|
||||
# - expression: has(request.resourceAttributes)
|
||||
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||
# subjectAccessReviewVersion: v1
|
||||
# timeout: 3s
|
||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||
# # webhook is the configuration for the webhook authorizer.
|
||||
# webhook:
|
||||
# connectionInfo:
|
||||
# type: InClusterConfig
|
||||
# failurePolicy: NoOpinion
|
||||
# matchConditionSubjectAccessReviewVersion: v1
|
||||
# subjectAccessReviewVersion: v1
|
||||
# timeout: 3s
|
||||
|
||||
# # Controller manager server specific configuration options.
|
||||
# controllerManager:
|
||||
# image: registry.k8s.io/kube-controller-manager:v1.34.0 # The container image used in the controller manager manifest.
|
||||
# # Extra arguments to supply to the controller manager.
|
||||
# extraArgs:
|
||||
# feature-gates: ServerSideApply=true
|
||||
|
||||
# # Kube-proxy server-specific configuration options
|
||||
# proxy:
|
||||
# disabled: false # Disable kube-proxy deployment on cluster bootstrap.
|
||||
# image: registry.k8s.io/kube-proxy:v1.34.0 # The container image used in the kube-proxy manifest.
|
||||
# mode: ipvs # proxy mode of kube-proxy.
|
||||
# # Extra arguments to supply to kube-proxy.
|
||||
# extraArgs:
|
||||
# proxy-mode: iptables
|
||||
|
||||
# # Scheduler server specific configuration options.
|
||||
# scheduler:
|
||||
# image: registry.k8s.io/kube-scheduler:v1.34.0 # The container image used in the scheduler manifest.
|
||||
# # Extra arguments to supply to the scheduler.
|
||||
# extraArgs:
|
||||
# feature-gates: AllBeta=true
|
||||
|
||||
# # Etcd specific configuration options.
|
||||
# etcd:
|
||||
# image: gcr.io/etcd-development/etcd:v3.6.4 # The container image used to create the etcd service.
|
||||
# # The `ca` is the root certificate authority of the PKI.
|
||||
# ca:
|
||||
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||
# # Extra arguments to supply to etcd.
|
||||
# extraArgs:
|
||||
# election-timeout: "5000"
|
||||
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||
# advertisedSubnets:
|
||||
# - 10.0.0.0/8
|
||||
|
||||
# # Core DNS specific configuration options.
|
||||
# coreDNS:
|
||||
# image: registry.k8s.io/coredns/coredns:v1.12.3 # The `image` field is an override to the default coredns image.
|
||||
|
||||
# # External cloud provider configuration.
|
||||
# externalCloudProvider:
|
||||
# enabled: true # Enable external cloud provider.
|
||||
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||
# manifests:
|
||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||
|
||||
# # A list of urls that point to additional manifests.
|
||||
# extraManifests:
|
||||
# - https://www.example.com/manifest1.yaml
|
||||
# - https://www.example.com/manifest2.yaml
|
||||
|
||||
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||
# extraManifestHeaders:
|
||||
# Token: "1234567"
|
||||
# X-ExtraInfo: info
|
||||
|
||||
# # A list of inline Kubernetes manifests.
|
||||
# inlineManifests:
|
||||
# - name: namespace-ci # Name of the manifest.
|
||||
# contents: |- # Manifest contents as a string.
|
||||
# apiVersion: v1
|
||||
# kind: Namespace
|
||||
# metadata:
|
||||
# name: ci
|
||||
|
||||
# # Settings for admin kubeconfig generation.
|
||||
# adminKubeconfig:
|
||||
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||
|
||||
# # Allows running workload on control-plane nodes.
|
||||
# allowSchedulingOnControlPlanes: true
|
||||
|
|
@ -49,7 +49,7 @@ resource "dnsimple_zone_record" "manero_us_a" {
|
|||
resource "dnsimple_zone_record" "manero_us_aaaa" {
|
||||
zone_name = "manero.org"
|
||||
name = "us"
|
||||
value = "2001:19f0:6401:19e6:5400:05ff:fe45:5701"
|
||||
value = "2001:19f0:6401:19e6:5400:5ff:fe45:5701"
|
||||
type = "AAAA"
|
||||
ttl = 3600
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,21 +1,3 @@
|
|||
# Commented out ProtonMail MX records - now using Mailcow
|
||||
# resource "dnsimple_zone_record" "mcintire_mx_10" {
|
||||
# zone_name = "mcintire.me"
|
||||
# name = "@"
|
||||
# value = "mail.protonmail.ch."
|
||||
# type = "MX"
|
||||
# ttl = 3600
|
||||
# priority = 10
|
||||
# }
|
||||
|
||||
# resource "dnsimple_zone_record" "mcintire_mx_20" {
|
||||
# zone_name = "mcintire.me"
|
||||
# name = "@"
|
||||
# value = "mailsec.protonmail.ch."
|
||||
# type = "MX"
|
||||
# ttl = 3600
|
||||
# priority = 20
|
||||
# }
|
||||
|
||||
# Mailcow MX record
|
||||
resource "dnsimple_zone_record" "mcintire_mx_mailcow" {
|
||||
|
|
@ -36,62 +18,8 @@ resource "dnsimple_zone_record" "mcintire_mx_backup" {
|
|||
ttl = 3600
|
||||
}
|
||||
|
||||
# Commented out ProtonMail SPF record - replaced with Mailcow SPF
|
||||
# resource "dnsimple_zone_record" "mcintire_txt_spf" {
|
||||
# zone_name = "mcintire.me"
|
||||
# name = "@"
|
||||
# value = "v=spf1 include:_spf.protonmail.ch ~all"
|
||||
# type = "TXT"
|
||||
# ttl = 3600
|
||||
# }
|
||||
|
||||
# Commented out basic DMARC record - replaced with Mailcow DMARC
|
||||
# resource "dnsimple_zone_record" "mcintire_txt_dmarc" {
|
||||
# zone_name = "mcintire.me"
|
||||
# name = "_dmarc"
|
||||
# value = "v=DMARC1; p=quarantine"
|
||||
# type = "TXT"
|
||||
# }
|
||||
|
||||
# Keep ProtonMail verification record for now
|
||||
resource "dnsimple_zone_record" "mcintire_txt_verification" {
|
||||
zone_name = "mcintire.me"
|
||||
name = "@"
|
||||
value = "protonmail-verification=e2d59d75d33081519c75e11908b30e206ad7324d"
|
||||
type = "TXT"
|
||||
}
|
||||
|
||||
resource "dnsimple_zone_record" "mcintire_cname_photos" {
|
||||
zone_name = "mcintire.me"
|
||||
name = "photos"
|
||||
value = "caddy.w5isp.com."
|
||||
type = "CNAME"
|
||||
ttl = 14400
|
||||
}
|
||||
|
||||
resource "dnsimple_zone_record" "mcintire_cname_protonmail_domainkey" {
|
||||
zone_name = "mcintire.me"
|
||||
name = "protonmail._domainkey"
|
||||
value = "protonmail.domainkey.dq7rufxozvkgaev373cchyg6cvrweh4mqtf6yazivom7mcw3yhdaq.domains.proton.ch."
|
||||
type = "CNAME"
|
||||
ttl = 259200
|
||||
}
|
||||
|
||||
resource "dnsimple_zone_record" "mcintire_cname_protonmail2_domainkey" {
|
||||
zone_name = "mcintire.me"
|
||||
name = "protonmail2._domainkey"
|
||||
value = "protonmail2.domainkey.dq7rufxozvkgaev373cchyg6cvrweh4mqtf6yazivom7mcw3yhdaq.domains.proton.ch."
|
||||
type = "CNAME"
|
||||
ttl = 259200
|
||||
}
|
||||
|
||||
resource "dnsimple_zone_record" "mcintire_cname_protonmail3_domainkey" {
|
||||
zone_name = "mcintire.me"
|
||||
name = "protonmail3._domainkey"
|
||||
value = "protonmail3.domainkey.dq7rufxozvkgaev373cchyg6cvrweh4mqtf6yazivom7mcw3yhdaq.domains.proton.ch."
|
||||
type = "CNAME"
|
||||
ttl = 259200
|
||||
}
|
||||
|
||||
resource "dnsimple_zone_record" "mcintire_cname_test" {
|
||||
zone_name = "mcintire.me"
|
||||
|
|
@ -142,7 +70,7 @@ resource "dnsimple_zone_record" "mcintire_autoconfig" {
|
|||
resource "dnsimple_zone_record" "mcintire_spf_mailcow" {
|
||||
zone_name = "mcintire.me"
|
||||
name = ""
|
||||
value = "v=spf1 mx a ip4:66.206.18.162 ~all"
|
||||
value = "\"v=spf1 mx a ip4:66.206.18.162 ~all\""
|
||||
type = "TXT"
|
||||
ttl = 3600
|
||||
}
|
||||
|
|
@ -151,7 +79,7 @@ resource "dnsimple_zone_record" "mcintire_spf_mailcow" {
|
|||
resource "dnsimple_zone_record" "mcintire_dmarc_mailcow" {
|
||||
zone_name = "mcintire.me"
|
||||
name = "_dmarc"
|
||||
value = "v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"
|
||||
value = "\"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1\""
|
||||
type = "TXT"
|
||||
ttl = 3600
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,26 +1,27 @@
|
|||
resource "porkbun_dns_record" "qth_root_a" {
|
||||
domain = "qth.social"
|
||||
name = ""
|
||||
type = "A"
|
||||
content = "204.110.191.203"
|
||||
priority = 0
|
||||
ttl = 3600
|
||||
}
|
||||
# Commented out due to Porkbun API issues
|
||||
# resource "porkbun_dns_record" "qth_root_a" {
|
||||
# domain = "qth.social"
|
||||
# name = ""
|
||||
# type = "A"
|
||||
# content = "204.110.191.203"
|
||||
# priority = 0
|
||||
# ttl = 3600
|
||||
# }
|
||||
|
||||
resource "porkbun_dns_record" "qth_root_aaaa" {
|
||||
domain = "qth.social"
|
||||
name = ""
|
||||
type = "AAAA"
|
||||
content = "2606:1c80::203"
|
||||
priority = 0
|
||||
ttl = 3600
|
||||
}
|
||||
# resource "porkbun_dns_record" "qth_root_aaaa" {
|
||||
# domain = "qth.social"
|
||||
# name = ""
|
||||
# type = "AAAA"
|
||||
# content = "2606:1c80::203"
|
||||
# priority = 0
|
||||
# ttl = 3600
|
||||
# }
|
||||
|
||||
resource "porkbun_dns_record" "qth_email_cname" {
|
||||
domain = "qth.social"
|
||||
name = "email.mastodon"
|
||||
type = "CNAME"
|
||||
content = "mailgun.org"
|
||||
priority = 0
|
||||
ttl = 3600
|
||||
}
|
||||
# resource "porkbun_dns_record" "qth_email_cname" {
|
||||
# domain = "qth.social"
|
||||
# name = "email.mastodon"
|
||||
# type = "CNAME"
|
||||
# content = "mailgun.org"
|
||||
# priority = 0
|
||||
# ttl = 3600
|
||||
# }
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
resource "dnsimple_zone_record" "w5isp_root" {
|
||||
zone_name = "w5isp.com"
|
||||
name = ""
|
||||
value = "204.110.191.212" # Points to Caddy proxy server
|
||||
value = "204.110.191.212"
|
||||
type = "A"
|
||||
ttl = 3600
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,8 +1,3 @@
|
|||
# Caddy Proxy Outputs
|
||||
output "caddy_proxy_ip" {
|
||||
description = "IP address of the Caddy proxy server"
|
||||
value = "204.110.191.212"
|
||||
}
|
||||
|
||||
|
||||
# # # Proxmox Outputs
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
Loading…
Add table
Reference in a new issue