From aae4fbdb9a1b1646e17bf389422afb06f9c6cf2b Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sat, 10 Jan 2026 16:24:40 -0600 Subject: [PATCH] clean talos config --- talos/CLUSTER_CONFIG.md | 114 ----- talos/apply-configs.sh | 28 -- talos/apply-worker-configs.sh | 53 --- .../letsencrypt-clusterissuer.yaml | 35 -- talos/cluster-config.yaml | 0 talos/controlplane.yaml | 403 ---------------- talos/current-config.yaml | 1 - talos/deploy-cluster-services.sh | 194 -------- talos/generate-node-configs.sh | 26 -- talos/kubeconfig | 28 -- talos/metallb/ipaddresspool-internal.yaml | 20 - talos/nodes/cp-1.yaml | 124 ----- talos/nodes/cp-2.yaml | 124 ----- talos/nodes/cp-3.yaml | 124 ----- talos/nodes/worker-1.yaml | 118 ----- talos/nodes/worker-2.yaml | 118 ----- talos/nodes/worker-3.yaml | 118 ----- talos/patches/cloud-provider.yaml | 4 - talos/patches/cp-1.yaml | 7 - talos/patches/cp-2.yaml | 7 - talos/patches/cp-3.yaml | 7 - .../patches/remove-controlplane-secrets.yaml | 2 - talos/patches/system-extensions.yaml | 28 -- talos/patches/tailscale-config.yaml | 7 - talos/patches/tailscale-extension-config.yaml | 14 - talos/patches/worker-1.yaml | 5 - talos/patches/worker-2.yaml | 5 - talos/patches/worker-3.yaml | 5 - talos/patches/worker-type.yaml | 5 - talos/provision-workers.sh | 78 ---- talos/proxmox-ccm/config.yaml | 6 - talos/proxmox-ccm/secret.yaml | 7 - talos/proxmox-csi/namespace.yaml | 8 - .../proxmox-csi/node-providerid-patches.yaml | 26 -- talos/proxmox-csi/secret.yaml | 18 - talos/proxmox-csi/storageclass.yaml | 14 - talos/proxmox-csi/values.yaml | 15 - talos/reset-vms.sh | 76 --- talos/schematic.yaml | 6 - talos/setup-proxmox-csi.sh | 43 -- talos/update-proxmox-csi-permissions.sh | 24 - talos/worker-base.yaml | 114 ----- talos/worker-base.yaml.backup | 121 ----- talos/worker.yaml | 433 ------------------ 44 files changed, 2713 deletions(-) delete mode 100644 talos/CLUSTER_CONFIG.md delete mode 100755 talos/apply-configs.sh delete mode 100755 talos/apply-worker-configs.sh delete mode 100644 talos/cert-manager/letsencrypt-clusterissuer.yaml delete mode 100644 talos/cluster-config.yaml delete mode 100644 talos/controlplane.yaml delete mode 100644 talos/current-config.yaml delete mode 100755 talos/deploy-cluster-services.sh delete mode 100755 talos/generate-node-configs.sh delete mode 100644 talos/kubeconfig delete mode 100644 talos/metallb/ipaddresspool-internal.yaml delete mode 100644 talos/nodes/cp-1.yaml delete mode 100644 talos/nodes/cp-2.yaml delete mode 100644 talos/nodes/cp-3.yaml delete mode 100644 talos/nodes/worker-1.yaml delete mode 100644 talos/nodes/worker-2.yaml delete mode 100644 talos/nodes/worker-3.yaml delete mode 100644 talos/patches/cloud-provider.yaml delete mode 100644 talos/patches/cp-1.yaml delete mode 100644 talos/patches/cp-2.yaml delete mode 100644 talos/patches/cp-3.yaml delete mode 100644 talos/patches/remove-controlplane-secrets.yaml delete mode 100644 talos/patches/system-extensions.yaml delete mode 100644 talos/patches/tailscale-config.yaml delete mode 100644 talos/patches/tailscale-extension-config.yaml delete mode 100644 talos/patches/worker-1.yaml delete mode 100644 talos/patches/worker-2.yaml delete mode 100644 talos/patches/worker-3.yaml delete mode 100644 talos/patches/worker-type.yaml delete mode 100755 talos/provision-workers.sh delete mode 100644 talos/proxmox-ccm/config.yaml delete mode 100644 talos/proxmox-ccm/secret.yaml delete mode 100644 talos/proxmox-csi/namespace.yaml delete mode 100644 talos/proxmox-csi/node-providerid-patches.yaml delete mode 100644 talos/proxmox-csi/secret.yaml delete mode 100644 talos/proxmox-csi/storageclass.yaml delete mode 100644 talos/proxmox-csi/values.yaml delete mode 100755 talos/reset-vms.sh delete mode 100644 talos/schematic.yaml delete mode 100755 talos/setup-proxmox-csi.sh delete mode 100644 talos/update-proxmox-csi-permissions.sh delete mode 100644 talos/worker-base.yaml delete mode 100644 talos/worker-base.yaml.backup delete mode 100644 talos/worker.yaml diff --git a/talos/CLUSTER_CONFIG.md b/talos/CLUSTER_CONFIG.md deleted file mode 100644 index 756e482..0000000 --- a/talos/CLUSTER_CONFIG.md +++ /dev/null @@ -1,114 +0,0 @@ -# Talos Cluster Configuration Notes - -## Proxmox Environment - -- **Proxmox Cluster ID**: 380 -- **Proxmox Node Name**: vm2-380 -- **Proxmox API**: https://10.0.0.2:8006/api2/json - -## Network Configuration - -### Private Network (Cluster Internal) -- **Network**: 10.0.0.0/24 -- **Control Plane Nodes**: - - cp-1: 10.0.0.101 (DHCP) - - cp-2: 10.0.0.102 (DHCP) - - cp-3: 10.0.0.103 (DHCP) -- **Interface**: eth0 (net0 in Proxmox, no VLAN tag) -- **Usage**: Kubernetes API, etcd, internal pod communication - -### Public Network (External Services) -- **Network**: 204.110.191.192/26 -- **Gateway**: 204.110.191.254 -- **Node IPs**: - - cp-1: 204.110.191.193/26 (static) - - cp-2: 204.110.191.194/26 (static) - - cp-3: 204.110.191.195/26 (static) -- **Interface**: eth1 (net1 in Proxmox, VLAN tag 9) -- **Usage**: MetalLB LoadBalancer services, external access - -### MetalLB IP Pool -- **Range**: 204.110.191.193-215 -- **Interface**: eth1 -- **Mode**: L2 Advertisement -- **IMPORTANT**: LoadBalancer services must use `externalTrafficPolicy: Cluster` (not `Local`) to avoid routing issues with L2 mode - -## Required Node Labels - -All nodes must have the following labels for proper CSI and scheduling: - -```bash -# Topology labels for Proxmox CSI -topology.kubernetes.io/region=380 -topology.kubernetes.io/zone=vm2-380 - -# Platform label for CSI DaemonSet -node.cloudprovider.kubernetes.io/platform=nocloud -``` - -## Proxmox VM IDs - -Map Kubernetes nodes to Proxmox VM IDs for CSI provider IDs: - -- talos-if6-e42: VM 203 → `proxmox://380/203` -- talos-sbl-bvx: VM 202 → `proxmox://380/202` -- talos-xgb-7n7: VM 201 → `proxmox://380/201` - -**Note**: These mappings may change when VMs are recreated. Update `proxmox-csi/node-providerid-patches.yaml` accordingly. - -## Storage Configuration - -- **StorageClass**: proxmox-local-lvm -- **Backend**: Proxmox local-lvm storage -- **Filesystem**: ext4 -- **Binding Mode**: WaitForFirstConsumer -- **Allowed Topology**: region=380 - -## Service Deployment Order - -1. **MetalLB** - LoadBalancer capability for public IPs -2. **NFS Provisioner** - Persistent storage via NFS (10.0.0.253:/mnt/k8s/cluster) -3. **Tailscale Operator** - Private network access to services -4. **DNS Services** - PowerDNS with external PostgreSQL -5. **Other services** - As needed - -## External Dependencies - -### PostgreSQL Database -- **Host**: 10.0.0.252 -- **Database**: powerdns -- **User**: powerdns -- **Running on**: Proxmox (outside Kubernetes) -- **Credentials**: Stored in 1Password (item: t3nqhjmeci6msx4qouu64yfr3q) -- **PowerDNS Version**: 4.8 (uses `Primary`/`Secondary` instead of `Master`/`Slave`) -- **Zone Type**: All zones must be type `Primary` to support AXFR zone transfers -- **AXFR Settings**: - - `allow-axfr-ips=204.87.183.53` - Allow zone transfers from secondary - - `also-notify=204.87.183.53` - Send notifications on zone updates - -### NFS Storage -- **Server**: 10.0.0.253 -- **Export**: /mnt/k8s/cluster -- **Provider**: TrueNAS -- **Configuration**: Maproot user/group set to root - -### Tailscale -- **OAuth Credentials**: Stored in 1Password (item: almzem6nffphe3xv4pgxpkbaga) -- **Namespace**: tailscale -- **PodSecurity**: Must be set to 'privileged' for proxy pods to run - -## Bootstrap Checklist - -After recreating cluster: - -- [ ] Apply node configs via talosctl -- [ ] Bootstrap cluster: `talosctl -n 10.0.0.101 bootstrap` -- [ ] Get kubeconfig: `talosctl kubeconfig --force` -- [ ] Remove control-plane taint: `kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule-` -- [ ] Deploy MetalLB for public LoadBalancer IPs -- [ ] Deploy NFS provisioner (10.0.0.253:/mnt/k8s/cluster) -- [ ] Deploy Tailscale operator: - - [ ] Set tailscale namespace to privileged PodSecurity - - [ ] Install operator with OAuth credentials from 1Password -- [ ] Verify external PostgreSQL is running (10.0.0.252) -- [ ] Deploy DNS services (PowerDNS) diff --git a/talos/apply-configs.sh b/talos/apply-configs.sh deleted file mode 100755 index e0308d6..0000000 --- a/talos/apply-configs.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash -set -e - -cd "$(dirname "$0")" - -echo "Applying configs to nodes..." - -echo " Applying config to talos-cp-1 (10.0.0.101)" -talosctl apply-config --insecure --nodes 10.0.0.101 --file nodes/cp-1.yaml --mode=auto - -echo " Applying config to talos-cp-2 (10.0.0.102)" -talosctl apply-config --insecure --nodes 10.0.0.102 --file nodes/cp-2.yaml --mode=auto - -echo " Applying config to talos-cp-3 (10.0.0.103)" -talosctl apply-config --insecure --nodes 10.0.0.103 --file nodes/cp-3.yaml --mode=auto - -echo "" -echo "Configs applied! Nodes will reboot and configure themselves." -echo "Wait about 2-3 minutes, then run:" -echo "" -echo " # Merge talosconfig" -echo " talosctl config merge talosconfig" -echo "" -echo " # Bootstrap the cluster (only run once!)" -echo " talosctl bootstrap --nodes 10.0.0.101" -echo "" -echo " # Check cluster health" -echo " talosctl health --nodes 10.0.0.101,10.0.0.102,10.0.0.103" diff --git a/talos/apply-worker-configs.sh b/talos/apply-worker-configs.sh deleted file mode 100755 index abd97c9..0000000 --- a/talos/apply-worker-configs.sh +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/bash -set -e - -cd "$(dirname "$0")" - -WORKER_IPS=(10.0.0.104 10.0.0.105 10.0.0.106) -WORKER_NAMES=(worker-1 worker-2 worker-3) - -echo "=== Applying Talos Worker Node Configurations ===" -echo "" - -# Apply worker configs -for i in "${!WORKER_IPS[@]}"; do - IP=${WORKER_IPS[$i]} - NAME=${WORKER_NAMES[$i]} - - echo "Applying config to $NAME ($IP)..." - talosctl apply-config \ - --nodes $IP \ - --file nodes/$NAME.yaml \ - --insecure - - echo " ✓ Applied to $NAME" - echo "" -done - -echo "=== Worker nodes configured! ===" -echo "" -echo "The worker nodes will now join the cluster." -echo "Waiting for nodes to appear in cluster..." -sleep 15 - -# Get the worker node names (they're auto-generated) -WORKER_NODES=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | grep -v -f <(kubectl get nodes -l node-role.kubernetes.io/control-plane -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') 2>/dev/null || true) - -if [ -n "$WORKER_NODES" ]; then - echo "Found worker nodes, applying labels..." - for node in $WORKER_NODES; do - echo " Labeling $node..." - kubectl label node $node \ - topology.kubernetes.io/region=380 \ - topology.kubernetes.io/zone=vm2-380 \ - node.cloudprovider.kubernetes.io/platform=nocloud \ - node-role.kubernetes.io/worker= \ - --overwrite - done - echo "" - echo "Worker nodes labeled successfully!" - kubectl get nodes -else - echo "No worker nodes found yet. Label them manually with:" - echo " kubectl label node topology.kubernetes.io/region=380 topology.kubernetes.io/zone=vm2-380 node.cloudprovider.kubernetes.io/platform=nocloud node-role.kubernetes.io/worker=" -fi diff --git a/talos/cert-manager/letsencrypt-clusterissuer.yaml b/talos/cert-manager/letsencrypt-clusterissuer.yaml deleted file mode 100644 index e119353..0000000 --- a/talos/cert-manager/letsencrypt-clusterissuer.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-prod -spec: - acme: - # Production Let's Encrypt server - server: https://acme-v02.api.letsencrypt.org/directory - email: graham@mcintire.me - privateKeySecretRef: - name: letsencrypt-prod - solvers: - # HTTP-01 solver with standalone pod - # cert-manager will create temporary pods to respond to challenges - - http01: - ingress: - ingressClassName: traefik ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - # Staging Let's Encrypt server (for testing, has higher rate limits) - server: https://acme-staging-v02.api.letsencrypt.org/directory - email: graham@mcintire.me - privateKeySecretRef: - name: letsencrypt-staging - solvers: - # HTTP-01 solver with standalone pod - # cert-manager will create temporary pods to respond to challenges - - http01: - ingress: - ingressClassName: traefik diff --git a/talos/cluster-config.yaml b/talos/cluster-config.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/talos/controlplane.yaml b/talos/controlplane.yaml deleted file mode 100644 index 6060c52..0000000 --- a/talos/controlplane.yaml +++ /dev/null @@ -1,403 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: controlplane # Defines the role of the machine within the cluster. - token: gwdkoe.5gbblli1cvxv1axx # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraMounts` field is used to add additional mounts to the kubelet container. - extraMounts: - - destination: /var/lib/kubelet/plugins # Destination is the absolute path where the mount will be placed in the container. - type: bind # Type specifies the mount kind. - source: /var/lib/kubelet/plugins # Source specifies the source path of the mount. - # Options are fstab style mount options. - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: {} - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 # Allows for supplying the image used to perform the installation. - wipe: false # Indicates if the installation disk should be wiped at installation time. - grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Allows the addition of user specified files. - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG # The contents of the file. - permissions: 0o600 # The file's permissions in octal. - path: /var/etc/tailscale/auth.key # The path of the file. - op: create # The operation to use - - content: 10.0.0.0/24 # The contents of the file. - permissions: 0o600 # The file's permissions in octal. - path: /var/etc/tailscale/routes # The path of the file. - op: create # The operation to use - - content: --accept-routes --advertise-tags=tag:k8s-cp # The contents of the file. - permissions: 0o600 # The file's permissions in octal. - path: /var/etc/tailscale/args # The path of the file. - op: create # The operation to use - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - # Configures the node labels for the machine. - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.0.101:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: vntx # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: 71gr3x.96za7btksx23r8bk # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded private key for service account token generation. - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - # API server specific configuration options. - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. - # Configure the API server admission plugins. - admissionControl: - - name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - # Configure the API server audit policy. - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - # Controller manager server specific configuration options. - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. - # Kube-proxy server-specific configuration options - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. - - # # Disable kube-proxy deployment on cluster bootstrap. - # disabled: false - # Scheduler server specific configuration options. - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - # Etcd specific configuration options. - etcd: - # The `ca` is the root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - - # # The container image used to create the etcd service. - # image: registry.k8s.io/etcd:v3.6.7 - - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - # A list of urls that point to additional manifests. - extraManifests: [] - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # A list of inline Kubernetes manifests. - inlineManifests: [] - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable # A method to automatically generate a hostname for the machine. - -# # A static hostname to set for the machine. -# hostname: controlplane1 -# hostname: controlplane1.example.org diff --git a/talos/current-config.yaml b/talos/current-config.yaml deleted file mode 100644 index 6c20382..0000000 --- a/talos/current-config.yaml +++ /dev/null @@ -1 +0,0 @@ -rpc error: code = NotFound desc = resource "config" is not registered diff --git a/talos/deploy-cluster-services.sh b/talos/deploy-cluster-services.sh deleted file mode 100755 index d0b5bbe..0000000 --- a/talos/deploy-cluster-services.sh +++ /dev/null @@ -1,194 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -# Talos Cluster Services Deployment Script -# This script deploys core infrastructure services in the correct order - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -VNTX_INFRA_DIR="$(dirname "$SCRIPT_DIR")" - -echo "=== Talos Cluster Services Deployment ===" -echo "" - -# Color output -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -NC='\033[0m' # No Color - -step() { - echo -e "${GREEN}==>${NC} $1" -} - -wait_for_pods() { - local namespace=$1 - local label=$2 - local timeout=${3:-120} - - echo "Waiting for pods in namespace $namespace with label $label..." - kubectl wait --for=condition=ready pod \ - -l "$label" \ - -n "$namespace" \ - --timeout="${timeout}s" 2>/dev/null || true -} - -# Step 0: Remove control-plane taint -step "0. Removing control-plane taint..." -kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule- 2>/dev/null || echo "Taint already removed or not present" - -echo "" - -# Step 1: Deploy MetalLB -step "1. Deploying MetalLB..." -kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.9/config/manifests/metallb-native.yaml - -echo "Waiting for MetalLB controller..." -wait_for_pods metallb-system component=controller 120 - -# Create memberlist secret if needed -kubectl get secret -n metallb-system memberlist &>/dev/null || \ - kubectl create secret generic -n metallb-system memberlist \ - --from-literal=secretkey="$(openssl rand -base64 128)" - -echo "Waiting for MetalLB speakers..." -wait_for_pods metallb-system component=speaker 120 - -step "Applying MetalLB IP pool configuration..." -kubectl apply -f "$VNTX_INFRA_DIR/contexts/metallb/ipaddresspool.yaml" - -echo "" - -# Step 2: Deploy NFS Provisioner -step "2. Deploying NFS Provisioner..." -helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/ 2>/dev/null || true -helm repo update - -helm upgrade --install nfs-subdir-external-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \ - --namespace nfs-provisioner \ - --create-namespace \ - --set nfs.server=10.0.0.253 \ - --set nfs.path=/mnt/k8s/cluster \ - --set storageClass.name=nfs \ - --set storageClass.defaultClass=true \ - --set storageClass.reclaimPolicy=Delete \ - --wait - -echo "" - -# Step 3: Deploy Tailscale Operator -step "3. Deploying Tailscale Operator..." - -# Set namespace to privileged for Tailscale proxies -kubectl create namespace tailscale 2>/dev/null || true -kubectl label namespace tailscale \ - pod-security.kubernetes.io/enforce=privileged \ - pod-security.kubernetes.io/audit=privileged \ - pod-security.kubernetes.io/warn=privileged \ - --overwrite - -# Get Tailscale OAuth credentials from 1Password -TAILSCALE_CLIENT_ID=$(op item get almzem6nffphe3xv4pgxpkbaga --account=YOOATCZZSVGH7AD6VABUVPORLI --fields client_id --reveal) -TAILSCALE_CLIENT_SECRET=$(op item get almzem6nffphe3xv4pgxpkbaga --account=YOOATCZZSVGH7AD6VABUVPORLI --fields client_secret --reveal) - -helm repo add tailscale https://pkgs.tailscale.com/helmcharts 2>/dev/null || true -helm repo update - -helm upgrade --install tailscale-operator tailscale/tailscale-operator \ - --namespace=tailscale \ - --set-string oauth.clientId="$TAILSCALE_CLIENT_ID" \ - --set-string oauth.clientSecret="$TAILSCALE_CLIENT_SECRET" \ - --wait - -echo "" - -# Step 4: Deploy DNS Services (PowerDNS) -step "4. Deploying DNS Services (PowerDNS)..." - -# Create PostgreSQL credentials secret from 1Password -kubectl create secret generic postgresql-credentials -n dns \ - --from-literal="POSTGRES_USER=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_USER --reveal)" \ - --from-literal="POSTGRES_PASSWORD=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_PASSWORD --reveal)" \ - --from-literal="POSTGRES_DB=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_DB --reveal)" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Create PowerDNS API secret from 1Password -kubectl create secret generic powerdns-secrets -n dns \ - --from-literal="API_KEY=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POWERDNS_API_KEY --reveal)" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Create PowerDNS config -kubectl create configmap powerdns-config -n dns --from-literal="pdns.conf=launch=gpgsql -gpgsql-host=10.0.0.252 -gpgsql-port=5432 -gpgsql-dbname=powerdns -gpgsql-user=powerdns -gpgsql-password=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_PASSWORD --reveal) -gpgsql-dnssec=yes - -receiver-threads=4 -distributor-threads=4 -reuseport=yes -max-tcp-connections=100 - -api=yes -api-key=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POWERDNS_API_KEY --reveal) -webserver=yes -webserver-address=0.0.0.0 -webserver-port=8081 -webserver-allow-from=0.0.0.0/0 -webserver-max-bodysize=10485760 - -local-address=0.0.0.0 -local-port=53 - -log-dns-queries=yes -loglevel=6" \ - --dry-run=client -o yaml | kubectl apply -f - - -# Deploy PowerDNS services and deployment -kubectl apply -f "$VNTX_INFRA_DIR/contexts/dns/powerdns-service.yaml" -kubectl apply -f "$VNTX_INFRA_DIR/contexts/dns/powerdns-deployment.yaml" - -echo "Waiting for PowerDNS..." -wait_for_pods dns app=powerdns 120 - -echo "" - -# Step 5: Verify deployment -step "5. Verifying deployment..." - -echo "" -echo "MetalLB Status:" -kubectl get pods -n metallb-system -echo "" -kubectl get ipaddresspool,l2advertisement -n metallb-system - -echo "" -echo "NFS Provisioner Status:" -kubectl get pods -n nfs-provisioner -echo "" -kubectl get storageclass - -echo "" -echo "Tailscale Operator Status:" -kubectl get pods -n tailscale -echo "" - -echo "" -echo "DNS Services Status:" -kubectl get pods,svc -n dns - -echo "" -echo -e "${GREEN}=== Deployment Complete ===${NC}" -echo "" -echo "Services deployed:" -echo " - MetalLB (Public LoadBalancer)" -echo " - NFS Provisioner (Storage from 10.0.0.253)" -echo " - Tailscale Operator (Private network access)" -echo " - PowerDNS (Authoritative DNS)" -echo "" -echo "External Dependencies:" -echo " - PostgreSQL: 10.0.0.252" -echo " - NFS: 10.0.0.253:/mnt/k8s/cluster" -echo "" -echo "LoadBalancer Services:" -kubectl get svc --all-namespaces -o wide | grep LoadBalancer || echo " No LoadBalancer services yet" diff --git a/talos/generate-node-configs.sh b/talos/generate-node-configs.sh deleted file mode 100755 index 07bbad6..0000000 --- a/talos/generate-node-configs.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -set -e - -cd "$(dirname "$0")" - -echo "Generating individual node configs..." - -# Generate control plane configs -for node in cp-1 cp-2 cp-3; do - echo " Creating nodes/${node}.yaml (control plane)" - talosctl machineconfig patch controlplane.yaml \ - --patch @patches/cloud-provider.yaml \ - --patch @patches/${node}.yaml \ - -o nodes/${node}.yaml -done - -# Generate worker configs -for node in worker-1 worker-2 worker-3; do - echo " Creating nodes/${node}.yaml (worker)" - talosctl machineconfig patch worker-base.yaml \ - --patch @patches/cloud-provider.yaml \ - --patch @patches/${node}.yaml \ - -o nodes/${node}.yaml -done - -echo "Done! Node configs created in nodes/" diff --git a/talos/kubeconfig b/talos/kubeconfig deleted file mode 100644 index 4584e21..0000000 --- a/talos/kubeconfig +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://10.0.0.101:6443 - name: vntx -contexts: -- context: - cluster: vntx - namespace: default - user: admin@vntx - name: admin@vntx -- context: - cluster: vntx - namespace: default - user: admin@vntx-1 - name: vntx -current-context: admin@vntx -kind: Config -users: -- name: admin@vntx - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoakNDQVN1Z0F3SUJBZ0lSQUxPR2NEbnd5alVRc1pBZTBXdUlQZUl3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TURFeU1UVTRNVGxhRncweU56QXhNREV5TVRVNApNamxhTUNreEZ6QVZCZ05WQkFvVERuTjVjM1JsYlRwdFlYTjBaWEp6TVE0d0RBWURWUVFERXdWaFpHMXBiakJaCk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkEvQ1VyajRzbTI3TG9sOVQ1cjhzMFZsQ0lKZmNEcUUKaTljcnp1M0lUdDYzbG9CVVByMXZyTVFwSzBvSEFsWmd5SjArSHVERjIrUElUU1JMQ1ZVcFFzcWpTREJHTUE0RwpBMVVkRHdFQi93UUVBd0lGb0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFqQWZCZ05WSFNNRUdEQVdnQlNkClhCd1cwa2VwQllHZHM1N0NwNm41bzgrczNEQUtCZ2dxaGtqT1BRUURBZ05KQURCR0FpRUExTmRjcUxPRmpUc1cKT3RRalhNeU1ucGZPMDJMQTFma1U0NHYzaERscTZ1TUNJUURBOEQyT29vdXk2K2JkNkoxeUs3UGIzeU9ud0JlcgpyY0lGM1luMlg1ZTFvZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUh2U2dSVVhyK1NYVTRZUTJCdTVUWWVoL2tZRFBsczd6Mm9mSU9ad3ZHR05vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRDhKU3VQaXliYnN1aVgxUG12eXpSV1VJZ2w5d09vU0wxeXZPN2NoTzNyZVdnRlErdlcrcwp4Q2tyU2djQ1ZtREluVDRlNE1YYjQ4aE5KRXNKVlNsQ3lnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -- name: admin@vntx-1 - user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoVENDQVN1Z0F3SUJBZ0lSQUtHcFVGbUpJaTh4cGwzUzN0bmRRZ3N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV5TWpnd01EQTFOVGRhRncweU5qRXlNamd3TURBMgpNRGRhTUNreEZ6QVZCZ05WQkFvVERuTjVjM1JsYlRwdFlYTjBaWEp6TVE0d0RBWURWUVFERXdWaFpHMXBiakJaCk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkRtZldUV2RnWXh1V3RIREE0NkdpS2VSTkRmc010ZGcKNnlYSUtRbzRsNVNabFFwaWs4ZXp1em9rQlIvUXdjYVJ1bGlEUktkOWlobGpIeGtWbDFPKzZnbWpTREJHTUE0RwpBMVVkRHdFQi93UUVBd0lGb0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFqQWZCZ05WSFNNRUdEQVdnQlNkClhCd1cwa2VwQllHZHM1N0NwNm41bzgrczNEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQTFrVWlsUmQ5MGdQc0MKRk5JZ2c5QkZzbUJzV1RBaDhJN05mRVFvMWxaeG1BSWhBSnZ6L2IzSnZ1T2V3UWUyNm54WloycWZuYStpemlRawo2VTlIVlZzNU5jZEoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNjK3UvaFFWVHB3V2RDSEt1U2ZneTlCMStYWml6ME1mcnVQS1N1eS9TV1NvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFT1o5Wk5aMkJqRzVhMGNNRGpvYUlwNUUwTit3eTEyRHJKY2dwQ2ppWGxKbVZDbUtUeDdPNwpPaVFGSDlEQnhwRzZXSU5FcDMyS0dXTWZHUldYVTc3cUNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/talos/metallb/ipaddresspool-internal.yaml b/talos/metallb/ipaddresspool-internal.yaml deleted file mode 100644 index 03e9cfd..0000000 --- a/talos/metallb/ipaddresspool-internal.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool -metadata: - name: internal-pool - namespace: metallb-system -spec: - addresses: - - 10.0.0.10-10.0.0.99 - autoAssign: true ---- -apiVersion: metallb.io/v1beta1 -kind: L2Advertisement -metadata: - name: internal-l2 - namespace: metallb-system -spec: - ipAddressPools: - - internal-pool - interfaces: - - eth0 diff --git a/talos/nodes/cp-1.yaml b/talos/nodes/cp-1.yaml deleted file mode 100644 index 09f91e5..0000000 --- a/talos/nodes/cp-1.yaml +++ /dev/null @@ -1,124 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: controlplane - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraArgs: - cloud-provider: external - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: - interfaces: - - interface: eth0 - dhcp: true - - interface: eth1 - dhcp: false - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} - etcd: - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/nodes/cp-2.yaml b/talos/nodes/cp-2.yaml deleted file mode 100644 index 09f91e5..0000000 --- a/talos/nodes/cp-2.yaml +++ /dev/null @@ -1,124 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: controlplane - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraArgs: - cloud-provider: external - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: - interfaces: - - interface: eth0 - dhcp: true - - interface: eth1 - dhcp: false - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} - etcd: - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/nodes/cp-3.yaml b/talos/nodes/cp-3.yaml deleted file mode 100644 index 09f91e5..0000000 --- a/talos/nodes/cp-3.yaml +++ /dev/null @@ -1,124 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: controlplane - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraArgs: - cloud-provider: external - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: - interfaces: - - interface: eth0 - dhcp: true - - interface: eth1 - dhcp: false - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} - etcd: - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/nodes/worker-1.yaml b/talos/nodes/worker-1.yaml deleted file mode 100644 index 00b4283..0000000 --- a/talos/nodes/worker-1.yaml +++ /dev/null @@ -1,118 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: worker - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraArgs: - cloud-provider: external - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: - interfaces: - - interface: eth0 - dhcp: true - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - serviceAccount: - key: "" - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/nodes/worker-2.yaml b/talos/nodes/worker-2.yaml deleted file mode 100644 index 00b4283..0000000 --- a/talos/nodes/worker-2.yaml +++ /dev/null @@ -1,118 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: worker - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraArgs: - cloud-provider: external - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: - interfaces: - - interface: eth0 - dhcp: true - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - serviceAccount: - key: "" - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/nodes/worker-3.yaml b/talos/nodes/worker-3.yaml deleted file mode 100644 index 00b4283..0000000 --- a/talos/nodes/worker-3.yaml +++ /dev/null @@ -1,118 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: worker - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraArgs: - cloud-provider: external - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: - interfaces: - - interface: eth0 - dhcp: true - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - serviceAccount: - key: "" - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/patches/cloud-provider.yaml b/talos/patches/cloud-provider.yaml deleted file mode 100644 index c9e7efa..0000000 --- a/talos/patches/cloud-provider.yaml +++ /dev/null @@ -1,4 +0,0 @@ -machine: - kubelet: - extraArgs: - cloud-provider: external diff --git a/talos/patches/cp-1.yaml b/talos/patches/cp-1.yaml deleted file mode 100644 index 94bc867..0000000 --- a/talos/patches/cp-1.yaml +++ /dev/null @@ -1,7 +0,0 @@ -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - - interface: eth1 - dhcp: false diff --git a/talos/patches/cp-2.yaml b/talos/patches/cp-2.yaml deleted file mode 100644 index 94bc867..0000000 --- a/talos/patches/cp-2.yaml +++ /dev/null @@ -1,7 +0,0 @@ -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - - interface: eth1 - dhcp: false diff --git a/talos/patches/cp-3.yaml b/talos/patches/cp-3.yaml deleted file mode 100644 index 94bc867..0000000 --- a/talos/patches/cp-3.yaml +++ /dev/null @@ -1,7 +0,0 @@ -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - - interface: eth1 - dhcp: false diff --git a/talos/patches/remove-controlplane-secrets.yaml b/talos/patches/remove-controlplane-secrets.yaml deleted file mode 100644 index c3401af..0000000 --- a/talos/patches/remove-controlplane-secrets.yaml +++ /dev/null @@ -1,2 +0,0 @@ -# This patch is no longer needed since we manually fixed worker-base.yaml -# Keeping file for reference but it won't be used diff --git a/talos/patches/system-extensions.yaml b/talos/patches/system-extensions.yaml deleted file mode 100644 index 23b7a3d..0000000 --- a/talos/patches/system-extensions.yaml +++ /dev/null @@ -1,28 +0,0 @@ -machine: - install: - extensions: - - image: ghcr.io/siderolabs/qemu-guest-agent:8.2.2 - - image: ghcr.io/siderolabs/iscsi-tools:v0.1.6 - - image: ghcr.io/siderolabs/tailscale:1.78.3 - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - path: /var/etc/tailscale/auth.key - op: create - permissions: 0o600 - - content: "10.0.0.0/24" - path: /var/etc/tailscale/routes - op: create - permissions: 0o600 - - content: "--accept-routes --advertise-tags=tag:k8s-cp" - path: /var/etc/tailscale/args - op: create - permissions: 0o600 - kubelet: - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw diff --git a/talos/patches/tailscale-config.yaml b/talos/patches/tailscale-config.yaml deleted file mode 100644 index d81b8a9..0000000 --- a/talos/patches/tailscale-config.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1alpha1 -kind: ExtensionServiceConfig -name: tailscale -environment: - - TS_AUTHKEY=tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - - TS_ROUTES=10.0.0.0/24 - - TS_EXTRA_ARGS=--accept-routes --advertise-tags=tag:k8s-cp diff --git a/talos/patches/tailscale-extension-config.yaml b/talos/patches/tailscale-extension-config.yaml deleted file mode 100644 index ae06ab0..0000000 --- a/talos/patches/tailscale-extension-config.yaml +++ /dev/null @@ -1,14 +0,0 @@ -machine: - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - path: /var/etc/tailscale/auth.key - op: create - permissions: 0o600 - - content: "10.0.0.0/24" - path: /var/etc/tailscale/routes - op: create - permissions: 0o600 - - content: "--accept-routes --advertise-tags=tag:k8s-cp" - path: /var/etc/tailscale/args - op: create - permissions: 0o600 diff --git a/talos/patches/worker-1.yaml b/talos/patches/worker-1.yaml deleted file mode 100644 index 0ade6d9..0000000 --- a/talos/patches/worker-1.yaml +++ /dev/null @@ -1,5 +0,0 @@ -machine: - network: - interfaces: - - interface: eth0 - dhcp: true diff --git a/talos/patches/worker-2.yaml b/talos/patches/worker-2.yaml deleted file mode 100644 index 0ade6d9..0000000 --- a/talos/patches/worker-2.yaml +++ /dev/null @@ -1,5 +0,0 @@ -machine: - network: - interfaces: - - interface: eth0 - dhcp: true diff --git a/talos/patches/worker-3.yaml b/talos/patches/worker-3.yaml deleted file mode 100644 index 0ade6d9..0000000 --- a/talos/patches/worker-3.yaml +++ /dev/null @@ -1,5 +0,0 @@ -machine: - network: - interfaces: - - interface: eth0 - dhcp: true diff --git a/talos/patches/worker-type.yaml b/talos/patches/worker-type.yaml deleted file mode 100644 index bf2fe64..0000000 --- a/talos/patches/worker-type.yaml +++ /dev/null @@ -1,5 +0,0 @@ -machine: - type: worker - # Remove control plane specific config - controlPlane: - null diff --git a/talos/provision-workers.sh b/talos/provision-workers.sh deleted file mode 100755 index 24b0395..0000000 --- a/talos/provision-workers.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -set -e - -TEMPLATE_ID=9001 -VM_IDS=(204 205 206) -VM_NAMES=(talos-worker-1 talos-worker-2 talos-worker-3) -VM_MACS=(BC:24:11:2D:7F:C4 BC:24:11:28:B5:ED BC:24:11:17:90:1B) - -echo "=== Proxmox Worker Node Provisioning Script ===" -echo "" -echo "This will:" -echo " 1. Stop and destroy VMs ${VM_IDS[@]}" -echo " 2. Clone fresh VMs from template $TEMPLATE_ID" -echo " 3. Set specific MAC addresses for consistent IPs" -echo " 4. Start the VMs" -echo "" -read -p "Continue? (y/n) " -n 1 -r -echo -if [[ ! $REPLY =~ ^[Yy]$ ]]; then - echo "Aborted." - exit 1 -fi - -# Stop and destroy VMs -echo "" -echo "Stopping and destroying VMs..." -for VM_ID in "${VM_IDS[@]}"; do - if qm status $VM_ID &>/dev/null; then - echo " Stopping VM $VM_ID..." - qm stop $VM_ID 2>/dev/null || true - sleep 2 - echo " Destroying VM $VM_ID..." - qm destroy $VM_ID - fi -done - -# Clone fresh VMs -echo "" -echo "Cloning fresh VMs from template $TEMPLATE_ID..." -for i in "${!VM_IDS[@]}"; do - VM_ID=${VM_IDS[$i]} - VM_NAME=${VM_NAMES[$i]} - echo " Cloning $VM_ID ($VM_NAME)..." - qm clone $TEMPLATE_ID $VM_ID --name $VM_NAME --full - - # Resize disk to 64G - qm resize $VM_ID scsi0 64G -done - -# Set MAC addresses and configure network -echo "" -echo "Setting MAC addresses..." -for i in "${!VM_IDS[@]}"; do - VM_ID=${VM_IDS[$i]} - MAC=${VM_MACS[$i]} - echo " VM $VM_ID: setting MAC to $MAC" - qm set $VM_ID --net0 virtio=$MAC,bridge=vmbr0 - - # Remove net1 if it exists (workers don't need public network) - qm set $VM_ID --delete net1 2>/dev/null || true -done - -# Start VMs -echo "" -echo "Starting VMs..." -for VM_ID in "${VM_IDS[@]}"; do - echo " Starting VM $VM_ID..." - qm start $VM_ID -done - -echo "" -echo "=== Done! ===" -echo "VMs are booting. Wait ~30 seconds for them to reach maintenance mode." -echo "They should have the same IPs: 10.0.0.104, 10.0.0.105, 10.0.0.106" -echo "" -echo "Next steps:" -echo " 1. ./generate-node-configs.sh" -echo " 2. ./apply-worker-configs.sh" diff --git a/talos/proxmox-ccm/config.yaml b/talos/proxmox-ccm/config.yaml deleted file mode 100644 index a688b8d..0000000 --- a/talos/proxmox-ccm/config.yaml +++ /dev/null @@ -1,6 +0,0 @@ -clusters: -- url: https://10.0.0.2:8006/api2/json - insecure: true - token_id: "kubernetes-csi@pve!csi" - token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73" - region: "380" diff --git a/talos/proxmox-ccm/secret.yaml b/talos/proxmox-ccm/secret.yaml deleted file mode 100644 index bdcdbcd..0000000 --- a/talos/proxmox-ccm/secret.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -data: - config.yaml: Y2x1c3RlcnM6Ci0gdXJsOiBodHRwczovLzEwLjAuMC4yOjgwMDYvYXBpMi9qc29uCiAgaW5zZWN1cmU6IHRydWUKICB0b2tlbl9pZDogImt1YmVybmV0ZXMtY3NpQHB2ZSFjc2kiCiAgdG9rZW5fc2VjcmV0OiAiZTEwODUwODYtNjhlZS00YTYwLWJjOWUtOWUwZTM2ZTQ2ZjczIgogIHJlZ2lvbjogIjM4MCIK -kind: Secret -metadata: - name: proxmox-cloud-controller-manager - namespace: kube-system diff --git a/talos/proxmox-csi/namespace.yaml b/talos/proxmox-csi/namespace.yaml deleted file mode 100644 index bbc67cd..0000000 --- a/talos/proxmox-csi/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: csi-proxmox - labels: - pod-security.kubernetes.io/enforce: privileged - pod-security.kubernetes.io/audit: baseline - pod-security.kubernetes.io/warn: baseline diff --git a/talos/proxmox-csi/node-providerid-patches.yaml b/talos/proxmox-csi/node-providerid-patches.yaml deleted file mode 100644 index c690ba1..0000000 --- a/talos/proxmox-csi/node-providerid-patches.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -# Patch for talos-if6-e42 (VM 203) -apiVersion: v1 -kind: Node -metadata: - name: talos-if6-e42 -spec: - providerID: proxmox://380/203 - ---- -# Patch for talos-sbl-bvx (VM 202) -apiVersion: v1 -kind: Node -metadata: - name: talos-sbl-bvx -spec: - providerID: proxmox://380/202 - ---- -# Patch for talos-xgb-7n7 (VM 201) -apiVersion: v1 -kind: Node -metadata: - name: talos-xgb-7n7 -spec: - providerID: proxmox://380/201 diff --git a/talos/proxmox-csi/secret.yaml b/talos/proxmox-csi/secret.yaml deleted file mode 100644 index 328c2ab..0000000 --- a/talos/proxmox-csi/secret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: proxmox-csi-plugin - namespace: csi-proxmox -stringData: - config.yaml: | - clusters: - - url: https://10.0.0.2:8006/api2/json - insecure: true - token_id: "kubernetes-csi@pve!csi" - token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73" - region: "380" - - url: https://10.0.0.1:8006/api2/json - insecure: true - token_id: "kubernetes-csi@pve!csi" - token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73" - region: "380" diff --git a/talos/proxmox-csi/storageclass.yaml b/talos/proxmox-csi/storageclass.yaml deleted file mode 100644 index 3e28c79..0000000 --- a/talos/proxmox-csi/storageclass.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: proxmox-local-lvm - annotations: - storageclass.kubernetes.io/is-default-class: "true" -provisioner: csi.proxmox.sinextra.dev -parameters: - storage: local-lvm - csi.storage.k8s.io/fstype: ext4 - cache: writethrough -allowVolumeExpansion: true -reclaimPolicy: Delete -volumeBindingMode: Immediate diff --git a/talos/proxmox-csi/values.yaml b/talos/proxmox-csi/values.yaml deleted file mode 100644 index ee49e54..0000000 --- a/talos/proxmox-csi/values.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Proxmox CSI Plugin Helm Values -config: - clusters: - - url: https://10.0.0.2:8006/api2/json - insecure: false - token_id: "kubernetes-csi@pve!csi" - token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73" - region: 380 - -storageClass: - - name: proxmox-local-lvm - storage: local-lvm - reclaimPolicy: Delete - fstype: ext4 - cache: writethrough diff --git a/talos/reset-vms.sh b/talos/reset-vms.sh deleted file mode 100755 index 29d3ba2..0000000 --- a/talos/reset-vms.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash -set -e - -TEMPLATE_ID=9001 -VM_IDS=(201 202 203) -VM_NAMES=(talos-cp-1 talos-cp-2 talos-cp-3) - -echo "=== Proxmox VM Reset Script ===" -echo "" -echo "This will:" -echo " 1. Save MAC addresses from VMs ${VM_IDS[@]}" -echo " 2. Stop and destroy those VMs" -echo " 3. Clone fresh VMs from template $TEMPLATE_ID" -echo " 4. Restore the original MAC addresses" -echo " 5. Start the VMs" -echo "" -read -p "Continue? (y/n) " -n 1 -r -echo -if [[ ! $REPLY =~ ^[Yy]$ ]]; then - echo "Aborted." - exit 1 -fi - -# Save MAC addresses -echo "" -echo "Saving MAC addresses..." -declare -A MACS -for i in "${!VM_IDS[@]}"; do - VM_ID=${VM_IDS[$i]} - MAC=$(qm config $VM_ID | grep "^net0:" | sed -n 's/.*virtio=\([^,]*\).*/\1/p') - MACS[$VM_ID]=$MAC - echo " VM $VM_ID: $MAC" -done - -# Stop and destroy VMs -echo "" -echo "Stopping and destroying VMs..." -for VM_ID in "${VM_IDS[@]}"; do - echo " Stopping VM $VM_ID..." - qm stop $VM_ID 2>/dev/null || true - sleep 2 - echo " Destroying VM $VM_ID..." - qm destroy $VM_ID -done - -# Clone fresh VMs -echo "" -echo "Cloning fresh VMs from template $TEMPLATE_ID..." -for i in "${!VM_IDS[@]}"; do - VM_ID=${VM_IDS[$i]} - VM_NAME=${VM_NAMES[$i]} - echo " Cloning $VM_ID ($VM_NAME)..." - qm clone $TEMPLATE_ID $VM_ID --name $VM_NAME --full -done - -# Restore MAC addresses -echo "" -echo "Restoring MAC addresses..." -for VM_ID in "${VM_IDS[@]}"; do - MAC=${MACS[$VM_ID]} - echo " VM $VM_ID: setting MAC to $MAC" - qm set $VM_ID --net0 virtio=$MAC,bridge=vmbr0 -done - -# Start VMs -echo "" -echo "Starting VMs..." -for VM_ID in "${VM_IDS[@]}"; do - echo " Starting VM $VM_ID..." - qm start $VM_ID -done - -echo "" -echo "=== Done! ===" -echo "VMs are booting. Wait ~30 seconds for them to reach maintenance mode." -echo "They should have the same IPs: 10.0.0.101, 10.0.0.102, 10.0.0.103" diff --git a/talos/schematic.yaml b/talos/schematic.yaml deleted file mode 100644 index a4a289f..0000000 --- a/talos/schematic.yaml +++ /dev/null @@ -1,6 +0,0 @@ -customization: - systemExtensions: - officialExtensions: - - siderolabs/qemu-guest-agent - - siderolabs/iscsi-tools - - siderolabs/tailscale diff --git a/talos/setup-proxmox-csi.sh b/talos/setup-proxmox-csi.sh deleted file mode 100755 index 814a102..0000000 --- a/talos/setup-proxmox-csi.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/bash -# Run this script on your Proxmox host (10.0.0.2) - -set -e - -echo "=== Proxmox CSI Setup ===" -echo "" - -# Create CSI role with required permissions -echo "Creating CSI role..." -pveum role add CSI -privs "VM.Audit VM.Config.Disk Datastore.Allocate Datastore.AllocateSpace Datastore.Audit" || echo "Role may already exist" - -# Create kubernetes-csi user -echo "Creating kubernetes-csi user..." -pveum user add kubernetes-csi@pve --comment "User for Kubernetes Proxmox CSI Plugin" || echo "User may already exist" - -# Add ACL for the user -echo "Setting ACL permissions..." -pveum aclmod / -user kubernetes-csi@pve -role CSI - -# Remove existing token if it exists -echo "Removing old token if exists..." -pveum user token remove kubernetes-csi@pve csi 2>/dev/null || true - -# Create API token -echo "Creating API token..." -pveum user token add kubernetes-csi@pve csi --privsep 0 --output-format json > /tmp/csi-token.json - -# Extract token details -TOKEN_ID=$(jq -r '.["full-tokenid"]' /tmp/csi-token.json) -TOKEN_SECRET=$(jq -r '.value' /tmp/csi-token.json) - -echo "" -echo "=== Setup Complete ===" -echo "" -echo "Token ID: $TOKEN_ID" -echo "Token Secret: $TOKEN_SECRET" -echo "" -echo "Save these values! You'll need them for Kubernetes configuration." -echo "" - -# Clean up -rm /tmp/csi-token.json diff --git a/talos/update-proxmox-csi-permissions.sh b/talos/update-proxmox-csi-permissions.sh deleted file mode 100644 index f1ee74f..0000000 --- a/talos/update-proxmox-csi-permissions.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# Run this script on your Proxmox host (10.0.0.2) to update CSI permissions - -set -e - -echo "=== Updating Proxmox CSI Permissions ===" -echo "" - -# Update CSI role with all required permissions -echo "Updating CSI role with comprehensive permissions..." -pveum role modify CSI -privs "VM.Audit VM.Config.Disk VM.Config.CDROM VM.Monitor VM.Allocate Datastore.Allocate Datastore.AllocateSpace Datastore.Audit" - -# Verify the role permissions -echo "" -echo "Current CSI role permissions:" -pveum role list | grep -A 1 CSI - -# Verify ACL is set -echo "" -echo "Current ACL for kubernetes-csi@pve:" -pveum acl list | grep kubernetes-csi - -echo "" -echo "=== Update Complete ===" diff --git a/talos/worker-base.yaml b/talos/worker-base.yaml deleted file mode 100644 index e89d2c0..0000000 --- a/talos/worker-base.yaml +++ /dev/null @@ -1,114 +0,0 @@ ---- -version: v1alpha1 -debug: false -persist: true -machine: - type: worker - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: null - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: {} - install: - disk: /dev/sda - image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: '' -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: null - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: null - serviceAccount: - key: null - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/worker-base.yaml.backup b/talos/worker-base.yaml.backup deleted file mode 100644 index 42c29cb..0000000 --- a/talos/worker-base.yaml.backup +++ /dev/null @@ -1,121 +0,0 @@ -version: v1alpha1 -debug: false -persist: true -machine: - type: worker - token: gwdkoe.5gbblli1cvxv1axx - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - certSANs: [] - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 - extraMounts: - - destination: /var/lib/kubelet/plugins - type: bind - source: /var/lib/kubelet/plugins - options: - - bind - - rshared - - rw - defaultRuntimeSeccompProfileEnabled: true - disableManifestsDirectory: true - network: {} - install: - disk: /dev/sda - image: ghcr.io/siderolabs/installer:v1.12.0 - extensions: - - image: ghcr.io/siderolabs/qemu-guest-agent:8.2.2 - - image: ghcr.io/siderolabs/iscsi-tools:v0.1.6 - - image: ghcr.io/siderolabs/tailscale:1.78.3 - wipe: false - grubUseUKICmdline: true - files: - - content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG - permissions: 0o600 - path: /var/etc/tailscale/auth.key - op: create - - content: 10.0.0.0/24 - permissions: 0o600 - path: /var/etc/tailscale/routes - op: create - - content: --accept-routes --advertise-tags=tag:k8s-cp - permissions: 0o600 - path: /var/etc/tailscale/args - op: create - features: - diskQuotaSupport: true - kubePrism: - enabled: true - port: 7445 - hostDNS: - enabled: true - forwardKubeDNSToHost: true - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" -cluster: - id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= - secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= - controlPlane: - endpoint: https://10.0.0.101:6443 - clusterName: vntx - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 71gr3x.96za7btksx23r8bk - secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - apiServer: - image: registry.k8s.io/kube-apiserver:v1.35.0 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.35.0 - proxy: - image: registry.k8s.io/kube-proxy:v1.35.0 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.35.0 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: {} - etcd: - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/talos/worker.yaml b/talos/worker.yaml deleted file mode 100644 index 59c8a35..0000000 --- a/talos/worker.yaml +++ /dev/null @@ -1,433 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: worker # Defines the role of the machine within the cluster. - token: crmyjb.dxygte3bpfb9bhbx # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJCTXQvK0c0T3h2dVJvZVhIZWVvaitNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNREV5TWpBeE16bGFGdzB6TlRFeU16QXlNakF4TXpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBZUZGeHM1ZjhlcEg5RFJ3WlZPVTBlM3NLbEdYQ3ZlbDZqU2pqCjRzOEp0WWVqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVNHluSml6aUYwbFFJUUVISwpnUzB3YmtyNmNKd3dCUVlESzJWd0EwRUFtdjZMNVRpem9YaTk0NXY2aU4rT2w4SDdHM0dCOFFyVXhMYnF5Nk1SCkdnNUtsZkVNYUhQTGlNMXVPaTNsd2FnWndhd2wvTDFVckNGdDhOdmNHQjZkQ2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. - # type: bind # Type specifies the mount kind. - # source: /var/lib/example # Source specifies the source path of the mount. - # # Options are fstab style mount options. - # options: - # - bind - # - rshared - # - rw - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: {} - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.12.0 # Allows for supplying the image used to perform the installation. - wipe: false # Indicates if the installation disk should be wiped at installation time. - grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - registries: {} - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: mTc4onTNw_N-wtS8vazkBogBrVccq9ESY6XEUgLP3NQ= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: c9Yv3y6djM9jG3Y7gN1lhmo35Fh0ap/eA4asTicPZEQ= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.0.101:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: vntx # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: kcout8.f7gf8hxd6jqvkiyb # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQU9LdVVqbjZ6UFR6WUdLLysrb0VtelF3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TURFeU1qQXhNemxhRncwek5URXlNekF5TWpBeApNemxhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVFSa0swVkNNSjIzeEJ3dTNlMWkySlhwUGVEcVdFOEJqZHR4dDMyNHBZY1B3Y2ljM0k0ZGFkejVRMHYKYU9aZ2FDb1NNanRYNWJ1ZCtQd0lLN1VGK0JNNW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTmg0MGZFV2lpa08vWXpqL3poNmJJQ1M3ODc5TUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUdNcVRGNjAKZlhqcU1zYUREMFEvU1VVWjhjdkZHazJ2aXRPOFlSdFk4QnZGQWlFQXpqTTY4cmRPSHMxb0wrK01HRmJvN1BzdgpVWTdya2xmbkJ6bjBDYmRsYTBFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable # A method to automatically generate a hostname for the machine. - -# # A static hostname to set for the machine. -# hostname: controlplane1 -# hostname: controlplane1.example.org