clean talos config
This commit is contained in:
parent
2dd9d44bf9
commit
aae4fbdb9a
44 changed files with 0 additions and 2713 deletions
|
|
@ -1,114 +0,0 @@
|
||||||
# Talos Cluster Configuration Notes
|
|
||||||
|
|
||||||
## Proxmox Environment
|
|
||||||
|
|
||||||
- **Proxmox Cluster ID**: 380
|
|
||||||
- **Proxmox Node Name**: vm2-380
|
|
||||||
- **Proxmox API**: https://10.0.0.2:8006/api2/json
|
|
||||||
|
|
||||||
## Network Configuration
|
|
||||||
|
|
||||||
### Private Network (Cluster Internal)
|
|
||||||
- **Network**: 10.0.0.0/24
|
|
||||||
- **Control Plane Nodes**:
|
|
||||||
- cp-1: 10.0.0.101 (DHCP)
|
|
||||||
- cp-2: 10.0.0.102 (DHCP)
|
|
||||||
- cp-3: 10.0.0.103 (DHCP)
|
|
||||||
- **Interface**: eth0 (net0 in Proxmox, no VLAN tag)
|
|
||||||
- **Usage**: Kubernetes API, etcd, internal pod communication
|
|
||||||
|
|
||||||
### Public Network (External Services)
|
|
||||||
- **Network**: 204.110.191.192/26
|
|
||||||
- **Gateway**: 204.110.191.254
|
|
||||||
- **Node IPs**:
|
|
||||||
- cp-1: 204.110.191.193/26 (static)
|
|
||||||
- cp-2: 204.110.191.194/26 (static)
|
|
||||||
- cp-3: 204.110.191.195/26 (static)
|
|
||||||
- **Interface**: eth1 (net1 in Proxmox, VLAN tag 9)
|
|
||||||
- **Usage**: MetalLB LoadBalancer services, external access
|
|
||||||
|
|
||||||
### MetalLB IP Pool
|
|
||||||
- **Range**: 204.110.191.193-215
|
|
||||||
- **Interface**: eth1
|
|
||||||
- **Mode**: L2 Advertisement
|
|
||||||
- **IMPORTANT**: LoadBalancer services must use `externalTrafficPolicy: Cluster` (not `Local`) to avoid routing issues with L2 mode
|
|
||||||
|
|
||||||
## Required Node Labels
|
|
||||||
|
|
||||||
All nodes must have the following labels for proper CSI and scheduling:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Topology labels for Proxmox CSI
|
|
||||||
topology.kubernetes.io/region=380
|
|
||||||
topology.kubernetes.io/zone=vm2-380
|
|
||||||
|
|
||||||
# Platform label for CSI DaemonSet
|
|
||||||
node.cloudprovider.kubernetes.io/platform=nocloud
|
|
||||||
```
|
|
||||||
|
|
||||||
## Proxmox VM IDs
|
|
||||||
|
|
||||||
Map Kubernetes nodes to Proxmox VM IDs for CSI provider IDs:
|
|
||||||
|
|
||||||
- talos-if6-e42: VM 203 → `proxmox://380/203`
|
|
||||||
- talos-sbl-bvx: VM 202 → `proxmox://380/202`
|
|
||||||
- talos-xgb-7n7: VM 201 → `proxmox://380/201`
|
|
||||||
|
|
||||||
**Note**: These mappings may change when VMs are recreated. Update `proxmox-csi/node-providerid-patches.yaml` accordingly.
|
|
||||||
|
|
||||||
## Storage Configuration
|
|
||||||
|
|
||||||
- **StorageClass**: proxmox-local-lvm
|
|
||||||
- **Backend**: Proxmox local-lvm storage
|
|
||||||
- **Filesystem**: ext4
|
|
||||||
- **Binding Mode**: WaitForFirstConsumer
|
|
||||||
- **Allowed Topology**: region=380
|
|
||||||
|
|
||||||
## Service Deployment Order
|
|
||||||
|
|
||||||
1. **MetalLB** - LoadBalancer capability for public IPs
|
|
||||||
2. **NFS Provisioner** - Persistent storage via NFS (10.0.0.253:/mnt/k8s/cluster)
|
|
||||||
3. **Tailscale Operator** - Private network access to services
|
|
||||||
4. **DNS Services** - PowerDNS with external PostgreSQL
|
|
||||||
5. **Other services** - As needed
|
|
||||||
|
|
||||||
## External Dependencies
|
|
||||||
|
|
||||||
### PostgreSQL Database
|
|
||||||
- **Host**: 10.0.0.252
|
|
||||||
- **Database**: powerdns
|
|
||||||
- **User**: powerdns
|
|
||||||
- **Running on**: Proxmox (outside Kubernetes)
|
|
||||||
- **Credentials**: Stored in 1Password (item: t3nqhjmeci6msx4qouu64yfr3q)
|
|
||||||
- **PowerDNS Version**: 4.8 (uses `Primary`/`Secondary` instead of `Master`/`Slave`)
|
|
||||||
- **Zone Type**: All zones must be type `Primary` to support AXFR zone transfers
|
|
||||||
- **AXFR Settings**:
|
|
||||||
- `allow-axfr-ips=204.87.183.53` - Allow zone transfers from secondary
|
|
||||||
- `also-notify=204.87.183.53` - Send notifications on zone updates
|
|
||||||
|
|
||||||
### NFS Storage
|
|
||||||
- **Server**: 10.0.0.253
|
|
||||||
- **Export**: /mnt/k8s/cluster
|
|
||||||
- **Provider**: TrueNAS
|
|
||||||
- **Configuration**: Maproot user/group set to root
|
|
||||||
|
|
||||||
### Tailscale
|
|
||||||
- **OAuth Credentials**: Stored in 1Password (item: almzem6nffphe3xv4pgxpkbaga)
|
|
||||||
- **Namespace**: tailscale
|
|
||||||
- **PodSecurity**: Must be set to 'privileged' for proxy pods to run
|
|
||||||
|
|
||||||
## Bootstrap Checklist
|
|
||||||
|
|
||||||
After recreating cluster:
|
|
||||||
|
|
||||||
- [ ] Apply node configs via talosctl
|
|
||||||
- [ ] Bootstrap cluster: `talosctl -n 10.0.0.101 bootstrap`
|
|
||||||
- [ ] Get kubeconfig: `talosctl kubeconfig --force`
|
|
||||||
- [ ] Remove control-plane taint: `kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule-`
|
|
||||||
- [ ] Deploy MetalLB for public LoadBalancer IPs
|
|
||||||
- [ ] Deploy NFS provisioner (10.0.0.253:/mnt/k8s/cluster)
|
|
||||||
- [ ] Deploy Tailscale operator:
|
|
||||||
- [ ] Set tailscale namespace to privileged PodSecurity
|
|
||||||
- [ ] Install operator with OAuth credentials from 1Password
|
|
||||||
- [ ] Verify external PostgreSQL is running (10.0.0.252)
|
|
||||||
- [ ] Deploy DNS services (PowerDNS)
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
cd "$(dirname "$0")"
|
|
||||||
|
|
||||||
echo "Applying configs to nodes..."
|
|
||||||
|
|
||||||
echo " Applying config to talos-cp-1 (10.0.0.101)"
|
|
||||||
talosctl apply-config --insecure --nodes 10.0.0.101 --file nodes/cp-1.yaml --mode=auto
|
|
||||||
|
|
||||||
echo " Applying config to talos-cp-2 (10.0.0.102)"
|
|
||||||
talosctl apply-config --insecure --nodes 10.0.0.102 --file nodes/cp-2.yaml --mode=auto
|
|
||||||
|
|
||||||
echo " Applying config to talos-cp-3 (10.0.0.103)"
|
|
||||||
talosctl apply-config --insecure --nodes 10.0.0.103 --file nodes/cp-3.yaml --mode=auto
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Configs applied! Nodes will reboot and configure themselves."
|
|
||||||
echo "Wait about 2-3 minutes, then run:"
|
|
||||||
echo ""
|
|
||||||
echo " # Merge talosconfig"
|
|
||||||
echo " talosctl config merge talosconfig"
|
|
||||||
echo ""
|
|
||||||
echo " # Bootstrap the cluster (only run once!)"
|
|
||||||
echo " talosctl bootstrap --nodes 10.0.0.101"
|
|
||||||
echo ""
|
|
||||||
echo " # Check cluster health"
|
|
||||||
echo " talosctl health --nodes 10.0.0.101,10.0.0.102,10.0.0.103"
|
|
||||||
|
|
@ -1,53 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
cd "$(dirname "$0")"
|
|
||||||
|
|
||||||
WORKER_IPS=(10.0.0.104 10.0.0.105 10.0.0.106)
|
|
||||||
WORKER_NAMES=(worker-1 worker-2 worker-3)
|
|
||||||
|
|
||||||
echo "=== Applying Talos Worker Node Configurations ==="
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Apply worker configs
|
|
||||||
for i in "${!WORKER_IPS[@]}"; do
|
|
||||||
IP=${WORKER_IPS[$i]}
|
|
||||||
NAME=${WORKER_NAMES[$i]}
|
|
||||||
|
|
||||||
echo "Applying config to $NAME ($IP)..."
|
|
||||||
talosctl apply-config \
|
|
||||||
--nodes $IP \
|
|
||||||
--file nodes/$NAME.yaml \
|
|
||||||
--insecure
|
|
||||||
|
|
||||||
echo " ✓ Applied to $NAME"
|
|
||||||
echo ""
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "=== Worker nodes configured! ==="
|
|
||||||
echo ""
|
|
||||||
echo "The worker nodes will now join the cluster."
|
|
||||||
echo "Waiting for nodes to appear in cluster..."
|
|
||||||
sleep 15
|
|
||||||
|
|
||||||
# Get the worker node names (they're auto-generated)
|
|
||||||
WORKER_NODES=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' | grep -v -f <(kubectl get nodes -l node-role.kubernetes.io/control-plane -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') 2>/dev/null || true)
|
|
||||||
|
|
||||||
if [ -n "$WORKER_NODES" ]; then
|
|
||||||
echo "Found worker nodes, applying labels..."
|
|
||||||
for node in $WORKER_NODES; do
|
|
||||||
echo " Labeling $node..."
|
|
||||||
kubectl label node $node \
|
|
||||||
topology.kubernetes.io/region=380 \
|
|
||||||
topology.kubernetes.io/zone=vm2-380 \
|
|
||||||
node.cloudprovider.kubernetes.io/platform=nocloud \
|
|
||||||
node-role.kubernetes.io/worker= \
|
|
||||||
--overwrite
|
|
||||||
done
|
|
||||||
echo ""
|
|
||||||
echo "Worker nodes labeled successfully!"
|
|
||||||
kubectl get nodes
|
|
||||||
else
|
|
||||||
echo "No worker nodes found yet. Label them manually with:"
|
|
||||||
echo " kubectl label node <node-name> topology.kubernetes.io/region=380 topology.kubernetes.io/zone=vm2-380 node.cloudprovider.kubernetes.io/platform=nocloud node-role.kubernetes.io/worker="
|
|
||||||
fi
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
# Production Let's Encrypt server
|
|
||||||
server: https://acme-v02.api.letsencrypt.org/directory
|
|
||||||
email: graham@mcintire.me
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
solvers:
|
|
||||||
# HTTP-01 solver with standalone pod
|
|
||||||
# cert-manager will create temporary pods to respond to challenges
|
|
||||||
- http01:
|
|
||||||
ingress:
|
|
||||||
ingressClassName: traefik
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: letsencrypt-staging
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
# Staging Let's Encrypt server (for testing, has higher rate limits)
|
|
||||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
||||||
email: graham@mcintire.me
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-staging
|
|
||||||
solvers:
|
|
||||||
# HTTP-01 solver with standalone pod
|
|
||||||
# cert-manager will create temporary pods to respond to challenges
|
|
||||||
- http01:
|
|
||||||
ingress:
|
|
||||||
ingressClassName: traefik
|
|
||||||
|
|
@ -1,403 +0,0 @@
|
||||||
version: v1alpha1 # Indicates the schema used to decode the contents.
|
|
||||||
debug: false # Enable verbose logging to the console.
|
|
||||||
persist: true
|
|
||||||
# Provides machine specific configuration options.
|
|
||||||
machine:
|
|
||||||
type: controlplane # Defines the role of the machine within the cluster.
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx # The `token` is used by a machine to join the PKI of the cluster.
|
|
||||||
# The root certificate authority of the PKI.
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
# Extra certificate subject alternative names for the machine's certificate.
|
|
||||||
certSANs: []
|
|
||||||
# # Uncomment this to enable SANs.
|
|
||||||
# - 10.0.0.10
|
|
||||||
# - 172.16.0.10
|
|
||||||
# - 192.168.0.10
|
|
||||||
|
|
||||||
# Used to provide additional options to the kubelet.
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
|
||||||
# The `extraMounts` field is used to add additional mounts to the kubelet container.
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins # Destination is the absolute path where the mount will be placed in the container.
|
|
||||||
type: bind # Type specifies the mount kind.
|
|
||||||
source: /var/lib/kubelet/plugins # Source specifies the source path of the mount.
|
|
||||||
# Options are fstab style mount options.
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
|
||||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
|
||||||
|
|
||||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
|
||||||
# clusterDNS:
|
|
||||||
# - 10.96.0.10
|
|
||||||
# - 169.254.2.53
|
|
||||||
|
|
||||||
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
|
||||||
# extraArgs:
|
|
||||||
# key: value
|
|
||||||
|
|
||||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
|
||||||
# extraConfig:
|
|
||||||
# serverTLSBootstrap: true
|
|
||||||
|
|
||||||
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
|
||||||
# credentialProviderConfig:
|
|
||||||
# apiVersion: kubelet.config.k8s.io/v1
|
|
||||||
# kind: CredentialProviderConfig
|
|
||||||
# providers:
|
|
||||||
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
|
||||||
# defaultCacheDuration: 12h
|
|
||||||
# matchImages:
|
|
||||||
# - '*.dkr.ecr.*.amazonaws.com'
|
|
||||||
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
|
||||||
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
|
||||||
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
|
||||||
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
|
||||||
# name: ecr-credential-provider
|
|
||||||
|
|
||||||
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
|
||||||
# nodeIP:
|
|
||||||
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
|
||||||
# validSubnets:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
# - '!10.0.0.3/32'
|
|
||||||
# - fdc7::/16
|
|
||||||
# Provides machine specific network configuration options.
|
|
||||||
network: {}
|
|
||||||
# # Configures KubeSpan feature.
|
|
||||||
# kubespan:
|
|
||||||
# enabled: true # Enable the KubeSpan feature.
|
|
||||||
|
|
||||||
# Used to provide instructions for installations.
|
|
||||||
install:
|
|
||||||
disk: /dev/sda # The disk used for installations.
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0 # Allows for supplying the image used to perform the installation.
|
|
||||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
|
||||||
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
|
||||||
|
|
||||||
# # Look up disk using disk attributes like model, size, serial and others.
|
|
||||||
# diskSelector:
|
|
||||||
# size: 4GB # Disk size.
|
|
||||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
|
||||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
|
||||||
# Allows the addition of user specified files.
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG # The contents of the file.
|
|
||||||
permissions: 0o600 # The file's permissions in octal.
|
|
||||||
path: /var/etc/tailscale/auth.key # The path of the file.
|
|
||||||
op: create # The operation to use
|
|
||||||
- content: 10.0.0.0/24 # The contents of the file.
|
|
||||||
permissions: 0o600 # The file's permissions in octal.
|
|
||||||
path: /var/etc/tailscale/routes # The path of the file.
|
|
||||||
op: create # The operation to use
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp # The contents of the file.
|
|
||||||
permissions: 0o600 # The file's permissions in octal.
|
|
||||||
path: /var/etc/tailscale/args # The path of the file.
|
|
||||||
op: create # The operation to use
|
|
||||||
# Features describe individual Talos features that can be switched on or off.
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
|
||||||
# KubePrism - local proxy/load balancer on defined port that will distribute
|
|
||||||
kubePrism:
|
|
||||||
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
|
||||||
port: 7445 # KubePrism port.
|
|
||||||
# Configures host DNS caching resolver.
|
|
||||||
hostDNS:
|
|
||||||
enabled: true # Enable host DNS caching resolver.
|
|
||||||
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
|
||||||
|
|
||||||
# # Configure Talos API access from Kubernetes pods.
|
|
||||||
# kubernetesTalosAPIAccess:
|
|
||||||
# enabled: true # Enable Talos API access from Kubernetes pods.
|
|
||||||
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
|
||||||
# allowedRoles:
|
|
||||||
# - os:reader
|
|
||||||
# # The list of Kubernetes namespaces Talos API access is available from.
|
|
||||||
# allowedKubernetesNamespaces:
|
|
||||||
# - kube-system
|
|
||||||
# Configures the node labels for the machine.
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
|
|
||||||
# # Provides machine specific control plane configuration options.
|
|
||||||
|
|
||||||
# # ControlPlane definition example.
|
|
||||||
# controlPlane:
|
|
||||||
# # Controller manager machine specific configuration options.
|
|
||||||
# controllerManager:
|
|
||||||
# disabled: false # Disable kube-controller-manager on the node.
|
|
||||||
# # Scheduler machine specific configuration options.
|
|
||||||
# scheduler:
|
|
||||||
# disabled: true # Disable kube-scheduler on the node.
|
|
||||||
|
|
||||||
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
|
||||||
|
|
||||||
# # nginx static pod.
|
|
||||||
# pods:
|
|
||||||
# - apiVersion: v1
|
|
||||||
# kind: pod
|
|
||||||
# metadata:
|
|
||||||
# name: nginx
|
|
||||||
# spec:
|
|
||||||
# containers:
|
|
||||||
# - image: nginx
|
|
||||||
# name: nginx
|
|
||||||
|
|
||||||
# # The `env` field allows for the addition of environment variables.
|
|
||||||
|
|
||||||
# # Environment variables definition examples.
|
|
||||||
# env:
|
|
||||||
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
|
||||||
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
|
||||||
# https_proxy: http://SERVER:PORT/
|
|
||||||
# env:
|
|
||||||
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
|
||||||
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
|
||||||
# env:
|
|
||||||
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
|
||||||
|
|
||||||
# # Used to configure the machine's sysctls.
|
|
||||||
|
|
||||||
# # MachineSysctls usage example.
|
|
||||||
# sysctls:
|
|
||||||
# kernel.domainname: talos.dev
|
|
||||||
# net.ipv4.ip_forward: "0"
|
|
||||||
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
|
||||||
|
|
||||||
# # Used to configure the machine's sysfs.
|
|
||||||
|
|
||||||
# # MachineSysfs usage example.
|
|
||||||
# sysfs:
|
|
||||||
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
|
||||||
|
|
||||||
# # Configures the udev system.
|
|
||||||
# udev:
|
|
||||||
# # List of udev rules to apply to the udev system
|
|
||||||
# rules:
|
|
||||||
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
|
||||||
|
|
||||||
# # Configures the logging system.
|
|
||||||
# logging:
|
|
||||||
# # Logging destination.
|
|
||||||
# destinations:
|
|
||||||
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
|
||||||
# format: json_lines # Logs format.
|
|
||||||
|
|
||||||
# # Configures the kernel.
|
|
||||||
# kernel:
|
|
||||||
# # Kernel modules to load.
|
|
||||||
# modules:
|
|
||||||
# - name: btrfs # Module name.
|
|
||||||
|
|
||||||
# # Configures the seccomp profiles for the machine.
|
|
||||||
# seccompProfiles:
|
|
||||||
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
|
||||||
# # The `value` field is used to provide the seccomp profile.
|
|
||||||
# value:
|
|
||||||
# defaultAction: SCMP_ACT_LOG
|
|
||||||
|
|
||||||
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
|
||||||
|
|
||||||
# # override default open file limit
|
|
||||||
# baseRuntimeSpecOverrides:
|
|
||||||
# process:
|
|
||||||
# rlimits:
|
|
||||||
# - hard: 1024
|
|
||||||
# soft: 1024
|
|
||||||
# type: RLIMIT_NOFILE
|
|
||||||
|
|
||||||
# # Configures the node annotations for the machine.
|
|
||||||
|
|
||||||
# # node annotations example.
|
|
||||||
# nodeAnnotations:
|
|
||||||
# customer.io/rack: r13a25
|
|
||||||
|
|
||||||
# # Configures the node taints for the machine. Effect is optional.
|
|
||||||
|
|
||||||
# # node taints example.
|
|
||||||
# nodeTaints:
|
|
||||||
# exampleTaint: exampleTaintValue:NoSchedule
|
|
||||||
# Provides cluster specific configuration options.
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4= # Shared secret of cluster (base64 encoded random 32 bytes).
|
|
||||||
# Provides control plane specific configuration options.
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
|
||||||
clusterName: vntx # Configures the cluster's name.
|
|
||||||
# Provides cluster specific network configuration options.
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
|
||||||
# The pod subnet CIDR.
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
# The service subnet CIDR.
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
|
|
||||||
# # The CNI used.
|
|
||||||
# cni:
|
|
||||||
# name: custom # Name of CNI to use.
|
|
||||||
# # URLs containing manifests to apply for the CNI.
|
|
||||||
# urls:
|
|
||||||
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
|
||||||
token: 71gr3x.96za7btksx23r8bk # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
|
||||||
# The base64 encoded root certificate authority used by Kubernetes.
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
# The base64 encoded private key for service account token generation.
|
|
||||||
serviceAccount:
|
|
||||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
# API server specific configuration options.
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
|
||||||
# Configure the API server admission plugins.
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity # Name is the name of the admission controller.
|
|
||||||
# Configuration is an embedded configuration object to be used as the plugin's
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
# Configure the API server audit policy.
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
|
|
||||||
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
|
||||||
# authorizationConfig:
|
|
||||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
|
||||||
# name: webhook # Name is used to describe the authorizer.
|
|
||||||
# # webhook is the configuration for the webhook authorizer.
|
|
||||||
# webhook:
|
|
||||||
# connectionInfo:
|
|
||||||
# type: InClusterConfig
|
|
||||||
# failurePolicy: Deny
|
|
||||||
# matchConditionSubjectAccessReviewVersion: v1
|
|
||||||
# matchConditions:
|
|
||||||
# - expression: has(request.resourceAttributes)
|
|
||||||
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
|
||||||
# subjectAccessReviewVersion: v1
|
|
||||||
# timeout: 3s
|
|
||||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
|
||||||
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
|
||||||
# # webhook is the configuration for the webhook authorizer.
|
|
||||||
# webhook:
|
|
||||||
# connectionInfo:
|
|
||||||
# type: InClusterConfig
|
|
||||||
# failurePolicy: NoOpinion
|
|
||||||
# matchConditionSubjectAccessReviewVersion: v1
|
|
||||||
# subjectAccessReviewVersion: v1
|
|
||||||
# timeout: 3s
|
|
||||||
# Controller manager server specific configuration options.
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
|
||||||
# Kube-proxy server-specific configuration options
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
|
||||||
|
|
||||||
# # Disable kube-proxy deployment on cluster bootstrap.
|
|
||||||
# disabled: false
|
|
||||||
# Scheduler server specific configuration options.
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
|
||||||
# Configures cluster member discovery.
|
|
||||||
discovery:
|
|
||||||
enabled: true # Enable the cluster membership discovery feature.
|
|
||||||
# Configure registries used for cluster member discovery.
|
|
||||||
registries:
|
|
||||||
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
|
||||||
kubernetes:
|
|
||||||
disabled: true # Disable Kubernetes discovery registry.
|
|
||||||
# Service registry is using an external service to push and pull information about cluster members.
|
|
||||||
service: {}
|
|
||||||
# # External service endpoint.
|
|
||||||
# endpoint: https://discovery.talos.dev/
|
|
||||||
# Etcd specific configuration options.
|
|
||||||
etcd:
|
|
||||||
# The `ca` is the root certificate authority of the PKI.
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
|
|
||||||
# # The container image used to create the etcd service.
|
|
||||||
# image: registry.k8s.io/etcd:v3.6.7
|
|
||||||
|
|
||||||
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
|
||||||
# advertisedSubnets:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
# A list of urls that point to additional manifests.
|
|
||||||
extraManifests: []
|
|
||||||
# - https://www.example.com/manifest1.yaml
|
|
||||||
# - https://www.example.com/manifest2.yaml
|
|
||||||
|
|
||||||
# A list of inline Kubernetes manifests.
|
|
||||||
inlineManifests: []
|
|
||||||
# - name: namespace-ci # Name of the manifest.
|
|
||||||
# contents: |- # Manifest contents as a string.
|
|
||||||
# apiVersion: v1
|
|
||||||
# kind: Namespace
|
|
||||||
# metadata:
|
|
||||||
# name: ci
|
|
||||||
|
|
||||||
|
|
||||||
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
|
||||||
|
|
||||||
# # Decryption secret example (do not use in production!).
|
|
||||||
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
|
||||||
|
|
||||||
# # Core DNS specific configuration options.
|
|
||||||
# coreDNS:
|
|
||||||
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
|
||||||
|
|
||||||
# # External cloud provider configuration.
|
|
||||||
# externalCloudProvider:
|
|
||||||
# enabled: true # Enable external cloud provider.
|
|
||||||
# # A list of urls that point to additional manifests for an external cloud provider.
|
|
||||||
# manifests:
|
|
||||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
|
||||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
|
||||||
|
|
||||||
# # A map of key value pairs that will be added while fetching the extraManifests.
|
|
||||||
# extraManifestHeaders:
|
|
||||||
# Token: "1234567"
|
|
||||||
# X-ExtraInfo: info
|
|
||||||
|
|
||||||
# # Settings for admin kubeconfig generation.
|
|
||||||
# adminKubeconfig:
|
|
||||||
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
|
||||||
|
|
||||||
# # Allows running workload on control-plane nodes.
|
|
||||||
# allowSchedulingOnControlPlanes: true
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable # A method to automatically generate a hostname for the machine.
|
|
||||||
|
|
||||||
# # A static hostname to set for the machine.
|
|
||||||
# hostname: controlplane1
|
|
||||||
# hostname: controlplane1.example.org
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
rpc error: code = NotFound desc = resource "config" is not registered
|
|
||||||
|
|
@ -1,194 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
# Talos Cluster Services Deployment Script
|
|
||||||
# This script deploys core infrastructure services in the correct order
|
|
||||||
|
|
||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
VNTX_INFRA_DIR="$(dirname "$SCRIPT_DIR")"
|
|
||||||
|
|
||||||
echo "=== Talos Cluster Services Deployment ==="
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Color output
|
|
||||||
GREEN='\033[0;32m'
|
|
||||||
YELLOW='\033[1;33m'
|
|
||||||
NC='\033[0m' # No Color
|
|
||||||
|
|
||||||
step() {
|
|
||||||
echo -e "${GREEN}==>${NC} $1"
|
|
||||||
}
|
|
||||||
|
|
||||||
wait_for_pods() {
|
|
||||||
local namespace=$1
|
|
||||||
local label=$2
|
|
||||||
local timeout=${3:-120}
|
|
||||||
|
|
||||||
echo "Waiting for pods in namespace $namespace with label $label..."
|
|
||||||
kubectl wait --for=condition=ready pod \
|
|
||||||
-l "$label" \
|
|
||||||
-n "$namespace" \
|
|
||||||
--timeout="${timeout}s" 2>/dev/null || true
|
|
||||||
}
|
|
||||||
|
|
||||||
# Step 0: Remove control-plane taint
|
|
||||||
step "0. Removing control-plane taint..."
|
|
||||||
kubectl taint nodes --all node-role.kubernetes.io/control-plane:NoSchedule- 2>/dev/null || echo "Taint already removed or not present"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Step 1: Deploy MetalLB
|
|
||||||
step "1. Deploying MetalLB..."
|
|
||||||
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.14.9/config/manifests/metallb-native.yaml
|
|
||||||
|
|
||||||
echo "Waiting for MetalLB controller..."
|
|
||||||
wait_for_pods metallb-system component=controller 120
|
|
||||||
|
|
||||||
# Create memberlist secret if needed
|
|
||||||
kubectl get secret -n metallb-system memberlist &>/dev/null || \
|
|
||||||
kubectl create secret generic -n metallb-system memberlist \
|
|
||||||
--from-literal=secretkey="$(openssl rand -base64 128)"
|
|
||||||
|
|
||||||
echo "Waiting for MetalLB speakers..."
|
|
||||||
wait_for_pods metallb-system component=speaker 120
|
|
||||||
|
|
||||||
step "Applying MetalLB IP pool configuration..."
|
|
||||||
kubectl apply -f "$VNTX_INFRA_DIR/contexts/metallb/ipaddresspool.yaml"
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Step 2: Deploy NFS Provisioner
|
|
||||||
step "2. Deploying NFS Provisioner..."
|
|
||||||
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/ 2>/dev/null || true
|
|
||||||
helm repo update
|
|
||||||
|
|
||||||
helm upgrade --install nfs-subdir-external-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
|
|
||||||
--namespace nfs-provisioner \
|
|
||||||
--create-namespace \
|
|
||||||
--set nfs.server=10.0.0.253 \
|
|
||||||
--set nfs.path=/mnt/k8s/cluster \
|
|
||||||
--set storageClass.name=nfs \
|
|
||||||
--set storageClass.defaultClass=true \
|
|
||||||
--set storageClass.reclaimPolicy=Delete \
|
|
||||||
--wait
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Step 3: Deploy Tailscale Operator
|
|
||||||
step "3. Deploying Tailscale Operator..."
|
|
||||||
|
|
||||||
# Set namespace to privileged for Tailscale proxies
|
|
||||||
kubectl create namespace tailscale 2>/dev/null || true
|
|
||||||
kubectl label namespace tailscale \
|
|
||||||
pod-security.kubernetes.io/enforce=privileged \
|
|
||||||
pod-security.kubernetes.io/audit=privileged \
|
|
||||||
pod-security.kubernetes.io/warn=privileged \
|
|
||||||
--overwrite
|
|
||||||
|
|
||||||
# Get Tailscale OAuth credentials from 1Password
|
|
||||||
TAILSCALE_CLIENT_ID=$(op item get almzem6nffphe3xv4pgxpkbaga --account=YOOATCZZSVGH7AD6VABUVPORLI --fields client_id --reveal)
|
|
||||||
TAILSCALE_CLIENT_SECRET=$(op item get almzem6nffphe3xv4pgxpkbaga --account=YOOATCZZSVGH7AD6VABUVPORLI --fields client_secret --reveal)
|
|
||||||
|
|
||||||
helm repo add tailscale https://pkgs.tailscale.com/helmcharts 2>/dev/null || true
|
|
||||||
helm repo update
|
|
||||||
|
|
||||||
helm upgrade --install tailscale-operator tailscale/tailscale-operator \
|
|
||||||
--namespace=tailscale \
|
|
||||||
--set-string oauth.clientId="$TAILSCALE_CLIENT_ID" \
|
|
||||||
--set-string oauth.clientSecret="$TAILSCALE_CLIENT_SECRET" \
|
|
||||||
--wait
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Step 4: Deploy DNS Services (PowerDNS)
|
|
||||||
step "4. Deploying DNS Services (PowerDNS)..."
|
|
||||||
|
|
||||||
# Create PostgreSQL credentials secret from 1Password
|
|
||||||
kubectl create secret generic postgresql-credentials -n dns \
|
|
||||||
--from-literal="POSTGRES_USER=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_USER --reveal)" \
|
|
||||||
--from-literal="POSTGRES_PASSWORD=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_PASSWORD --reveal)" \
|
|
||||||
--from-literal="POSTGRES_DB=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_DB --reveal)" \
|
|
||||||
--dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
|
|
||||||
# Create PowerDNS API secret from 1Password
|
|
||||||
kubectl create secret generic powerdns-secrets -n dns \
|
|
||||||
--from-literal="API_KEY=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POWERDNS_API_KEY --reveal)" \
|
|
||||||
--dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
|
|
||||||
# Create PowerDNS config
|
|
||||||
kubectl create configmap powerdns-config -n dns --from-literal="pdns.conf=launch=gpgsql
|
|
||||||
gpgsql-host=10.0.0.252
|
|
||||||
gpgsql-port=5432
|
|
||||||
gpgsql-dbname=powerdns
|
|
||||||
gpgsql-user=powerdns
|
|
||||||
gpgsql-password=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POSTGRES_PASSWORD --reveal)
|
|
||||||
gpgsql-dnssec=yes
|
|
||||||
|
|
||||||
receiver-threads=4
|
|
||||||
distributor-threads=4
|
|
||||||
reuseport=yes
|
|
||||||
max-tcp-connections=100
|
|
||||||
|
|
||||||
api=yes
|
|
||||||
api-key=$(op item get t3nqhjmeci6msx4qouu64yfr3q --account=YOOATCZZSVGH7AD6VABUVPORLI --fields POWERDNS_API_KEY --reveal)
|
|
||||||
webserver=yes
|
|
||||||
webserver-address=0.0.0.0
|
|
||||||
webserver-port=8081
|
|
||||||
webserver-allow-from=0.0.0.0/0
|
|
||||||
webserver-max-bodysize=10485760
|
|
||||||
|
|
||||||
local-address=0.0.0.0
|
|
||||||
local-port=53
|
|
||||||
|
|
||||||
log-dns-queries=yes
|
|
||||||
loglevel=6" \
|
|
||||||
--dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
|
|
||||||
# Deploy PowerDNS services and deployment
|
|
||||||
kubectl apply -f "$VNTX_INFRA_DIR/contexts/dns/powerdns-service.yaml"
|
|
||||||
kubectl apply -f "$VNTX_INFRA_DIR/contexts/dns/powerdns-deployment.yaml"
|
|
||||||
|
|
||||||
echo "Waiting for PowerDNS..."
|
|
||||||
wait_for_pods dns app=powerdns 120
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Step 5: Verify deployment
|
|
||||||
step "5. Verifying deployment..."
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "MetalLB Status:"
|
|
||||||
kubectl get pods -n metallb-system
|
|
||||||
echo ""
|
|
||||||
kubectl get ipaddresspool,l2advertisement -n metallb-system
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "NFS Provisioner Status:"
|
|
||||||
kubectl get pods -n nfs-provisioner
|
|
||||||
echo ""
|
|
||||||
kubectl get storageclass
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "Tailscale Operator Status:"
|
|
||||||
kubectl get pods -n tailscale
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "DNS Services Status:"
|
|
||||||
kubectl get pods,svc -n dns
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo -e "${GREEN}=== Deployment Complete ===${NC}"
|
|
||||||
echo ""
|
|
||||||
echo "Services deployed:"
|
|
||||||
echo " - MetalLB (Public LoadBalancer)"
|
|
||||||
echo " - NFS Provisioner (Storage from 10.0.0.253)"
|
|
||||||
echo " - Tailscale Operator (Private network access)"
|
|
||||||
echo " - PowerDNS (Authoritative DNS)"
|
|
||||||
echo ""
|
|
||||||
echo "External Dependencies:"
|
|
||||||
echo " - PostgreSQL: 10.0.0.252"
|
|
||||||
echo " - NFS: 10.0.0.253:/mnt/k8s/cluster"
|
|
||||||
echo ""
|
|
||||||
echo "LoadBalancer Services:"
|
|
||||||
kubectl get svc --all-namespaces -o wide | grep LoadBalancer || echo " No LoadBalancer services yet"
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
cd "$(dirname "$0")"
|
|
||||||
|
|
||||||
echo "Generating individual node configs..."
|
|
||||||
|
|
||||||
# Generate control plane configs
|
|
||||||
for node in cp-1 cp-2 cp-3; do
|
|
||||||
echo " Creating nodes/${node}.yaml (control plane)"
|
|
||||||
talosctl machineconfig patch controlplane.yaml \
|
|
||||||
--patch @patches/cloud-provider.yaml \
|
|
||||||
--patch @patches/${node}.yaml \
|
|
||||||
-o nodes/${node}.yaml
|
|
||||||
done
|
|
||||||
|
|
||||||
# Generate worker configs
|
|
||||||
for node in worker-1 worker-2 worker-3; do
|
|
||||||
echo " Creating nodes/${node}.yaml (worker)"
|
|
||||||
talosctl machineconfig patch worker-base.yaml \
|
|
||||||
--patch @patches/cloud-provider.yaml \
|
|
||||||
--patch @patches/${node}.yaml \
|
|
||||||
-o nodes/${node}.yaml
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "Done! Node configs created in nodes/"
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
clusters:
|
|
||||||
- cluster:
|
|
||||||
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
server: https://10.0.0.101:6443
|
|
||||||
name: vntx
|
|
||||||
contexts:
|
|
||||||
- context:
|
|
||||||
cluster: vntx
|
|
||||||
namespace: default
|
|
||||||
user: admin@vntx
|
|
||||||
name: admin@vntx
|
|
||||||
- context:
|
|
||||||
cluster: vntx
|
|
||||||
namespace: default
|
|
||||||
user: admin@vntx-1
|
|
||||||
name: vntx
|
|
||||||
current-context: admin@vntx
|
|
||||||
kind: Config
|
|
||||||
users:
|
|
||||||
- name: admin@vntx
|
|
||||||
user:
|
|
||||||
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoakNDQVN1Z0F3SUJBZ0lSQUxPR2NEbnd5alVRc1pBZTBXdUlQZUl3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TURFeU1UVTRNVGxhRncweU56QXhNREV5TVRVNApNamxhTUNreEZ6QVZCZ05WQkFvVERuTjVjM1JsYlRwdFlYTjBaWEp6TVE0d0RBWURWUVFERXdWaFpHMXBiakJaCk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkEvQ1VyajRzbTI3TG9sOVQ1cjhzMFZsQ0lKZmNEcUUKaTljcnp1M0lUdDYzbG9CVVByMXZyTVFwSzBvSEFsWmd5SjArSHVERjIrUElUU1JMQ1ZVcFFzcWpTREJHTUE0RwpBMVVkRHdFQi93UUVBd0lGb0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFqQWZCZ05WSFNNRUdEQVdnQlNkClhCd1cwa2VwQllHZHM1N0NwNm41bzgrczNEQUtCZ2dxaGtqT1BRUURBZ05KQURCR0FpRUExTmRjcUxPRmpUc1cKT3RRalhNeU1ucGZPMDJMQTFma1U0NHYzaERscTZ1TUNJUURBOEQyT29vdXk2K2JkNkoxeUs3UGIzeU9ud0JlcgpyY0lGM1luMlg1ZTFvZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
||||||
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUh2U2dSVVhyK1NYVTRZUTJCdTVUWWVoL2tZRFBsczd6Mm9mSU9ad3ZHR05vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRDhKU3VQaXliYnN1aVgxUG12eXpSV1VJZ2w5d09vU0wxeXZPN2NoTzNyZVdnRlErdlcrcwp4Q2tyU2djQ1ZtREluVDRlNE1YYjQ4aE5KRXNKVlNsQ3lnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
- name: admin@vntx-1
|
|
||||||
user:
|
|
||||||
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJoVENDQVN1Z0F3SUJBZ0lSQUtHcFVGbUpJaTh4cGwzUzN0bmRRZ3N3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOVEV5TWpnd01EQTFOVGRhRncweU5qRXlNamd3TURBMgpNRGRhTUNreEZ6QVZCZ05WQkFvVERuTjVjM1JsYlRwdFlYTjBaWEp6TVE0d0RBWURWUVFERXdWaFpHMXBiakJaCk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkRtZldUV2RnWXh1V3RIREE0NkdpS2VSTkRmc010ZGcKNnlYSUtRbzRsNVNabFFwaWs4ZXp1em9rQlIvUXdjYVJ1bGlEUktkOWlobGpIeGtWbDFPKzZnbWpTREJHTUE0RwpBMVVkRHdFQi93UUVBd0lGb0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFqQWZCZ05WSFNNRUdEQVdnQlNkClhCd1cwa2VwQllHZHM1N0NwNm41bzgrczNEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpQTFrVWlsUmQ5MGdQc0MKRk5JZ2c5QkZzbUJzV1RBaDhJN05mRVFvMWxaeG1BSWhBSnZ6L2IzSnZ1T2V3UWUyNm54WloycWZuYStpemlRawo2VTlIVlZzNU5jZEoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
|
||||||
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNjK3UvaFFWVHB3V2RDSEt1U2ZneTlCMStYWml6ME1mcnVQS1N1eS9TV1NvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFT1o5Wk5aMkJqRzVhMGNNRGpvYUlwNUUwTit3eTEyRHJKY2dwQ2ppWGxKbVZDbUtUeDdPNwpPaVFGSDlEQnhwRzZXSU5FcDMyS0dXTWZHUldYVTc3cUNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
apiVersion: metallb.io/v1beta1
|
|
||||||
kind: IPAddressPool
|
|
||||||
metadata:
|
|
||||||
name: internal-pool
|
|
||||||
namespace: metallb-system
|
|
||||||
spec:
|
|
||||||
addresses:
|
|
||||||
- 10.0.0.10-10.0.0.99
|
|
||||||
autoAssign: true
|
|
||||||
---
|
|
||||||
apiVersion: metallb.io/v1beta1
|
|
||||||
kind: L2Advertisement
|
|
||||||
metadata:
|
|
||||||
name: internal-l2
|
|
||||||
namespace: metallb-system
|
|
||||||
spec:
|
|
||||||
ipAddressPools:
|
|
||||||
- internal-pool
|
|
||||||
interfaces:
|
|
||||||
- eth0
|
|
||||||
|
|
@ -1,124 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: controlplane
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
- interface: eth1
|
|
||||||
dhcp: false
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
serviceAccount:
|
|
||||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
etcd:
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,124 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: controlplane
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
- interface: eth1
|
|
||||||
dhcp: false
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
serviceAccount:
|
|
||||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
etcd:
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,124 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: controlplane
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
- interface: eth1
|
|
||||||
dhcp: false
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
serviceAccount:
|
|
||||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
etcd:
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,118 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: worker
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
serviceAccount:
|
|
||||||
key: ""
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,118 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: worker
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
serviceAccount:
|
|
||||||
key: ""
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,118 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: worker
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
serviceAccount:
|
|
||||||
key: ""
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
machine:
|
|
||||||
kubelet:
|
|
||||||
extraArgs:
|
|
||||||
cloud-provider: external
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
machine:
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
- interface: eth1
|
|
||||||
dhcp: false
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
machine:
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
- interface: eth1
|
|
||||||
dhcp: false
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
machine:
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
- interface: eth1
|
|
||||||
dhcp: false
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
# This patch is no longer needed since we manually fixed worker-base.yaml
|
|
||||||
# Keeping file for reference but it won't be used
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
machine:
|
|
||||||
install:
|
|
||||||
extensions:
|
|
||||||
- image: ghcr.io/siderolabs/qemu-guest-agent:8.2.2
|
|
||||||
- image: ghcr.io/siderolabs/iscsi-tools:v0.1.6
|
|
||||||
- image: ghcr.io/siderolabs/tailscale:1.78.3
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
permissions: 0o600
|
|
||||||
- content: "10.0.0.0/24"
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
permissions: 0o600
|
|
||||||
- content: "--accept-routes --advertise-tags=tag:k8s-cp"
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
permissions: 0o600
|
|
||||||
kubelet:
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: ExtensionServiceConfig
|
|
||||||
name: tailscale
|
|
||||||
environment:
|
|
||||||
- TS_AUTHKEY=tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
- TS_ROUTES=10.0.0.0/24
|
|
||||||
- TS_EXTRA_ARGS=--accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
machine:
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
permissions: 0o600
|
|
||||||
- content: "10.0.0.0/24"
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
permissions: 0o600
|
|
||||||
- content: "--accept-routes --advertise-tags=tag:k8s-cp"
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
permissions: 0o600
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
machine:
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
machine:
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
machine:
|
|
||||||
network:
|
|
||||||
interfaces:
|
|
||||||
- interface: eth0
|
|
||||||
dhcp: true
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
machine:
|
|
||||||
type: worker
|
|
||||||
# Remove control plane specific config
|
|
||||||
controlPlane:
|
|
||||||
null
|
|
||||||
|
|
@ -1,78 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
TEMPLATE_ID=9001
|
|
||||||
VM_IDS=(204 205 206)
|
|
||||||
VM_NAMES=(talos-worker-1 talos-worker-2 talos-worker-3)
|
|
||||||
VM_MACS=(BC:24:11:2D:7F:C4 BC:24:11:28:B5:ED BC:24:11:17:90:1B)
|
|
||||||
|
|
||||||
echo "=== Proxmox Worker Node Provisioning Script ==="
|
|
||||||
echo ""
|
|
||||||
echo "This will:"
|
|
||||||
echo " 1. Stop and destroy VMs ${VM_IDS[@]}"
|
|
||||||
echo " 2. Clone fresh VMs from template $TEMPLATE_ID"
|
|
||||||
echo " 3. Set specific MAC addresses for consistent IPs"
|
|
||||||
echo " 4. Start the VMs"
|
|
||||||
echo ""
|
|
||||||
read -p "Continue? (y/n) " -n 1 -r
|
|
||||||
echo
|
|
||||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
|
||||||
echo "Aborted."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Stop and destroy VMs
|
|
||||||
echo ""
|
|
||||||
echo "Stopping and destroying VMs..."
|
|
||||||
for VM_ID in "${VM_IDS[@]}"; do
|
|
||||||
if qm status $VM_ID &>/dev/null; then
|
|
||||||
echo " Stopping VM $VM_ID..."
|
|
||||||
qm stop $VM_ID 2>/dev/null || true
|
|
||||||
sleep 2
|
|
||||||
echo " Destroying VM $VM_ID..."
|
|
||||||
qm destroy $VM_ID
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# Clone fresh VMs
|
|
||||||
echo ""
|
|
||||||
echo "Cloning fresh VMs from template $TEMPLATE_ID..."
|
|
||||||
for i in "${!VM_IDS[@]}"; do
|
|
||||||
VM_ID=${VM_IDS[$i]}
|
|
||||||
VM_NAME=${VM_NAMES[$i]}
|
|
||||||
echo " Cloning $VM_ID ($VM_NAME)..."
|
|
||||||
qm clone $TEMPLATE_ID $VM_ID --name $VM_NAME --full
|
|
||||||
|
|
||||||
# Resize disk to 64G
|
|
||||||
qm resize $VM_ID scsi0 64G
|
|
||||||
done
|
|
||||||
|
|
||||||
# Set MAC addresses and configure network
|
|
||||||
echo ""
|
|
||||||
echo "Setting MAC addresses..."
|
|
||||||
for i in "${!VM_IDS[@]}"; do
|
|
||||||
VM_ID=${VM_IDS[$i]}
|
|
||||||
MAC=${VM_MACS[$i]}
|
|
||||||
echo " VM $VM_ID: setting MAC to $MAC"
|
|
||||||
qm set $VM_ID --net0 virtio=$MAC,bridge=vmbr0
|
|
||||||
|
|
||||||
# Remove net1 if it exists (workers don't need public network)
|
|
||||||
qm set $VM_ID --delete net1 2>/dev/null || true
|
|
||||||
done
|
|
||||||
|
|
||||||
# Start VMs
|
|
||||||
echo ""
|
|
||||||
echo "Starting VMs..."
|
|
||||||
for VM_ID in "${VM_IDS[@]}"; do
|
|
||||||
echo " Starting VM $VM_ID..."
|
|
||||||
qm start $VM_ID
|
|
||||||
done
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "=== Done! ==="
|
|
||||||
echo "VMs are booting. Wait ~30 seconds for them to reach maintenance mode."
|
|
||||||
echo "They should have the same IPs: 10.0.0.104, 10.0.0.105, 10.0.0.106"
|
|
||||||
echo ""
|
|
||||||
echo "Next steps:"
|
|
||||||
echo " 1. ./generate-node-configs.sh"
|
|
||||||
echo " 2. ./apply-worker-configs.sh"
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
clusters:
|
|
||||||
- url: https://10.0.0.2:8006/api2/json
|
|
||||||
insecure: true
|
|
||||||
token_id: "kubernetes-csi@pve!csi"
|
|
||||||
token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73"
|
|
||||||
region: "380"
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
config.yaml: Y2x1c3RlcnM6Ci0gdXJsOiBodHRwczovLzEwLjAuMC4yOjgwMDYvYXBpMi9qc29uCiAgaW5zZWN1cmU6IHRydWUKICB0b2tlbl9pZDogImt1YmVybmV0ZXMtY3NpQHB2ZSFjc2kiCiAgdG9rZW5fc2VjcmV0OiAiZTEwODUwODYtNjhlZS00YTYwLWJjOWUtOWUwZTM2ZTQ2ZjczIgogIHJlZ2lvbjogIjM4MCIK
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: proxmox-cloud-controller-manager
|
|
||||||
namespace: kube-system
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: csi-proxmox
|
|
||||||
labels:
|
|
||||||
pod-security.kubernetes.io/enforce: privileged
|
|
||||||
pod-security.kubernetes.io/audit: baseline
|
|
||||||
pod-security.kubernetes.io/warn: baseline
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
---
|
|
||||||
# Patch for talos-if6-e42 (VM 203)
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Node
|
|
||||||
metadata:
|
|
||||||
name: talos-if6-e42
|
|
||||||
spec:
|
|
||||||
providerID: proxmox://380/203
|
|
||||||
|
|
||||||
---
|
|
||||||
# Patch for talos-sbl-bvx (VM 202)
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Node
|
|
||||||
metadata:
|
|
||||||
name: talos-sbl-bvx
|
|
||||||
spec:
|
|
||||||
providerID: proxmox://380/202
|
|
||||||
|
|
||||||
---
|
|
||||||
# Patch for talos-xgb-7n7 (VM 201)
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Node
|
|
||||||
metadata:
|
|
||||||
name: talos-xgb-7n7
|
|
||||||
spec:
|
|
||||||
providerID: proxmox://380/201
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: proxmox-csi-plugin
|
|
||||||
namespace: csi-proxmox
|
|
||||||
stringData:
|
|
||||||
config.yaml: |
|
|
||||||
clusters:
|
|
||||||
- url: https://10.0.0.2:8006/api2/json
|
|
||||||
insecure: true
|
|
||||||
token_id: "kubernetes-csi@pve!csi"
|
|
||||||
token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73"
|
|
||||||
region: "380"
|
|
||||||
- url: https://10.0.0.1:8006/api2/json
|
|
||||||
insecure: true
|
|
||||||
token_id: "kubernetes-csi@pve!csi"
|
|
||||||
token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73"
|
|
||||||
region: "380"
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
apiVersion: storage.k8s.io/v1
|
|
||||||
kind: StorageClass
|
|
||||||
metadata:
|
|
||||||
name: proxmox-local-lvm
|
|
||||||
annotations:
|
|
||||||
storageclass.kubernetes.io/is-default-class: "true"
|
|
||||||
provisioner: csi.proxmox.sinextra.dev
|
|
||||||
parameters:
|
|
||||||
storage: local-lvm
|
|
||||||
csi.storage.k8s.io/fstype: ext4
|
|
||||||
cache: writethrough
|
|
||||||
allowVolumeExpansion: true
|
|
||||||
reclaimPolicy: Delete
|
|
||||||
volumeBindingMode: Immediate
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
# Proxmox CSI Plugin Helm Values
|
|
||||||
config:
|
|
||||||
clusters:
|
|
||||||
- url: https://10.0.0.2:8006/api2/json
|
|
||||||
insecure: false
|
|
||||||
token_id: "kubernetes-csi@pve!csi"
|
|
||||||
token_secret: "e1085086-68ee-4a60-bc9e-9e0e36e46f73"
|
|
||||||
region: 380
|
|
||||||
|
|
||||||
storageClass:
|
|
||||||
- name: proxmox-local-lvm
|
|
||||||
storage: local-lvm
|
|
||||||
reclaimPolicy: Delete
|
|
||||||
fstype: ext4
|
|
||||||
cache: writethrough
|
|
||||||
|
|
@ -1,76 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
TEMPLATE_ID=9001
|
|
||||||
VM_IDS=(201 202 203)
|
|
||||||
VM_NAMES=(talos-cp-1 talos-cp-2 talos-cp-3)
|
|
||||||
|
|
||||||
echo "=== Proxmox VM Reset Script ==="
|
|
||||||
echo ""
|
|
||||||
echo "This will:"
|
|
||||||
echo " 1. Save MAC addresses from VMs ${VM_IDS[@]}"
|
|
||||||
echo " 2. Stop and destroy those VMs"
|
|
||||||
echo " 3. Clone fresh VMs from template $TEMPLATE_ID"
|
|
||||||
echo " 4. Restore the original MAC addresses"
|
|
||||||
echo " 5. Start the VMs"
|
|
||||||
echo ""
|
|
||||||
read -p "Continue? (y/n) " -n 1 -r
|
|
||||||
echo
|
|
||||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
|
||||||
echo "Aborted."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Save MAC addresses
|
|
||||||
echo ""
|
|
||||||
echo "Saving MAC addresses..."
|
|
||||||
declare -A MACS
|
|
||||||
for i in "${!VM_IDS[@]}"; do
|
|
||||||
VM_ID=${VM_IDS[$i]}
|
|
||||||
MAC=$(qm config $VM_ID | grep "^net0:" | sed -n 's/.*virtio=\([^,]*\).*/\1/p')
|
|
||||||
MACS[$VM_ID]=$MAC
|
|
||||||
echo " VM $VM_ID: $MAC"
|
|
||||||
done
|
|
||||||
|
|
||||||
# Stop and destroy VMs
|
|
||||||
echo ""
|
|
||||||
echo "Stopping and destroying VMs..."
|
|
||||||
for VM_ID in "${VM_IDS[@]}"; do
|
|
||||||
echo " Stopping VM $VM_ID..."
|
|
||||||
qm stop $VM_ID 2>/dev/null || true
|
|
||||||
sleep 2
|
|
||||||
echo " Destroying VM $VM_ID..."
|
|
||||||
qm destroy $VM_ID
|
|
||||||
done
|
|
||||||
|
|
||||||
# Clone fresh VMs
|
|
||||||
echo ""
|
|
||||||
echo "Cloning fresh VMs from template $TEMPLATE_ID..."
|
|
||||||
for i in "${!VM_IDS[@]}"; do
|
|
||||||
VM_ID=${VM_IDS[$i]}
|
|
||||||
VM_NAME=${VM_NAMES[$i]}
|
|
||||||
echo " Cloning $VM_ID ($VM_NAME)..."
|
|
||||||
qm clone $TEMPLATE_ID $VM_ID --name $VM_NAME --full
|
|
||||||
done
|
|
||||||
|
|
||||||
# Restore MAC addresses
|
|
||||||
echo ""
|
|
||||||
echo "Restoring MAC addresses..."
|
|
||||||
for VM_ID in "${VM_IDS[@]}"; do
|
|
||||||
MAC=${MACS[$VM_ID]}
|
|
||||||
echo " VM $VM_ID: setting MAC to $MAC"
|
|
||||||
qm set $VM_ID --net0 virtio=$MAC,bridge=vmbr0
|
|
||||||
done
|
|
||||||
|
|
||||||
# Start VMs
|
|
||||||
echo ""
|
|
||||||
echo "Starting VMs..."
|
|
||||||
for VM_ID in "${VM_IDS[@]}"; do
|
|
||||||
echo " Starting VM $VM_ID..."
|
|
||||||
qm start $VM_ID
|
|
||||||
done
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "=== Done! ==="
|
|
||||||
echo "VMs are booting. Wait ~30 seconds for them to reach maintenance mode."
|
|
||||||
echo "They should have the same IPs: 10.0.0.101, 10.0.0.102, 10.0.0.103"
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
customization:
|
|
||||||
systemExtensions:
|
|
||||||
officialExtensions:
|
|
||||||
- siderolabs/qemu-guest-agent
|
|
||||||
- siderolabs/iscsi-tools
|
|
||||||
- siderolabs/tailscale
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# Run this script on your Proxmox host (10.0.0.2)
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
echo "=== Proxmox CSI Setup ==="
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Create CSI role with required permissions
|
|
||||||
echo "Creating CSI role..."
|
|
||||||
pveum role add CSI -privs "VM.Audit VM.Config.Disk Datastore.Allocate Datastore.AllocateSpace Datastore.Audit" || echo "Role may already exist"
|
|
||||||
|
|
||||||
# Create kubernetes-csi user
|
|
||||||
echo "Creating kubernetes-csi user..."
|
|
||||||
pveum user add kubernetes-csi@pve --comment "User for Kubernetes Proxmox CSI Plugin" || echo "User may already exist"
|
|
||||||
|
|
||||||
# Add ACL for the user
|
|
||||||
echo "Setting ACL permissions..."
|
|
||||||
pveum aclmod / -user kubernetes-csi@pve -role CSI
|
|
||||||
|
|
||||||
# Remove existing token if it exists
|
|
||||||
echo "Removing old token if exists..."
|
|
||||||
pveum user token remove kubernetes-csi@pve csi 2>/dev/null || true
|
|
||||||
|
|
||||||
# Create API token
|
|
||||||
echo "Creating API token..."
|
|
||||||
pveum user token add kubernetes-csi@pve csi --privsep 0 --output-format json > /tmp/csi-token.json
|
|
||||||
|
|
||||||
# Extract token details
|
|
||||||
TOKEN_ID=$(jq -r '.["full-tokenid"]' /tmp/csi-token.json)
|
|
||||||
TOKEN_SECRET=$(jq -r '.value' /tmp/csi-token.json)
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "=== Setup Complete ==="
|
|
||||||
echo ""
|
|
||||||
echo "Token ID: $TOKEN_ID"
|
|
||||||
echo "Token Secret: $TOKEN_SECRET"
|
|
||||||
echo ""
|
|
||||||
echo "Save these values! You'll need them for Kubernetes configuration."
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Clean up
|
|
||||||
rm /tmp/csi-token.json
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
# Run this script on your Proxmox host (10.0.0.2) to update CSI permissions
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
echo "=== Updating Proxmox CSI Permissions ==="
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Update CSI role with all required permissions
|
|
||||||
echo "Updating CSI role with comprehensive permissions..."
|
|
||||||
pveum role modify CSI -privs "VM.Audit VM.Config.Disk VM.Config.CDROM VM.Monitor VM.Allocate Datastore.Allocate Datastore.AllocateSpace Datastore.Audit"
|
|
||||||
|
|
||||||
# Verify the role permissions
|
|
||||||
echo ""
|
|
||||||
echo "Current CSI role permissions:"
|
|
||||||
pveum role list | grep -A 1 CSI
|
|
||||||
|
|
||||||
# Verify ACL is set
|
|
||||||
echo ""
|
|
||||||
echo "Current ACL for kubernetes-csi@pve:"
|
|
||||||
pveum acl list | grep kubernetes-csi
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "=== Update Complete ==="
|
|
||||||
|
|
@ -1,114 +0,0 @@
|
||||||
---
|
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: worker
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: null
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network: {}
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: factory.talos.dev/installer/959b38c028569ff2f710c3cfcb3f90d4015282b278f020bb58cf1bda1f9ef93a:v1.12.0
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ''
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: null
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: null
|
|
||||||
serviceAccount:
|
|
||||||
key: null
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,121 +0,0 @@
|
||||||
version: v1alpha1
|
|
||||||
debug: false
|
|
||||||
persist: true
|
|
||||||
machine:
|
|
||||||
type: worker
|
|
||||||
token: gwdkoe.5gbblli1cvxv1axx
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBbk5ucllpRDF4bjZaaGVFY0hvTFZ5ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNakkzTWpNeU5UVTNXaGNOTXpVeE1qSTFNak15TlRVM1dqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBLMlRCTm5nWlhkRHRDQjBQRXprV0JxNW4zUk0zN0w3c1N1CkVrMGkveGRYbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkxFS0lGTWRTR09pZ09LaQozd3kzR0tWMGp2RDVNQVVHQXl0bGNBTkJBSmlXMEJqNGlaUHpwY2ZWWkhKWXk3dXphOWovOTBIZFJJcHpkdkwzCnc4U1RBcWs2emh0bFoyMVhEWlY1Y05vTWZpc0o0eC8zMzg1MXB6WTN6NHZBYVFvPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJT0xneGYyN041VXhnUStER3NoZU04dThzdnlCbE8vUmRMYUpETEFHOEF3TAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
certSANs: []
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0
|
|
||||||
extraMounts:
|
|
||||||
- destination: /var/lib/kubelet/plugins
|
|
||||||
type: bind
|
|
||||||
source: /var/lib/kubelet/plugins
|
|
||||||
options:
|
|
||||||
- bind
|
|
||||||
- rshared
|
|
||||||
- rw
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true
|
|
||||||
disableManifestsDirectory: true
|
|
||||||
network: {}
|
|
||||||
install:
|
|
||||||
disk: /dev/sda
|
|
||||||
image: ghcr.io/siderolabs/installer:v1.12.0
|
|
||||||
extensions:
|
|
||||||
- image: ghcr.io/siderolabs/qemu-guest-agent:8.2.2
|
|
||||||
- image: ghcr.io/siderolabs/iscsi-tools:v0.1.6
|
|
||||||
- image: ghcr.io/siderolabs/tailscale:1.78.3
|
|
||||||
wipe: false
|
|
||||||
grubUseUKICmdline: true
|
|
||||||
files:
|
|
||||||
- content: tskey-auth-k6cryUGtC521CNTRL-vnjxfuqSqs2Es4kX2SG1s2p3btRizMiG
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/auth.key
|
|
||||||
op: create
|
|
||||||
- content: 10.0.0.0/24
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/routes
|
|
||||||
op: create
|
|
||||||
- content: --accept-routes --advertise-tags=tag:k8s-cp
|
|
||||||
permissions: 0o600
|
|
||||||
path: /var/etc/tailscale/args
|
|
||||||
op: create
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true
|
|
||||||
kubePrism:
|
|
||||||
enabled: true
|
|
||||||
port: 7445
|
|
||||||
hostDNS:
|
|
||||||
enabled: true
|
|
||||||
forwardKubeDNSToHost: true
|
|
||||||
nodeLabels:
|
|
||||||
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
|
||||||
cluster:
|
|
||||||
id: eKSkTfDUW0U4if1QcK9otzZnNktorUsvnndBrHM4WBE=
|
|
||||||
secret: UumfthEFQUDRssdtWbbVezTJJZOtIIw3Db6f342SwW4=
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443
|
|
||||||
clusterName: vntx
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
token: 71gr3x.96za7btksx23r8bk
|
|
||||||
secretboxEncryptionSecret: 1+h+VmWKw3PPspmZ/+u27nhznTt8lRBd9RQQuepZ5/E=
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRVUxsZy9jbEovUkRzVFo1WHNvR0I3VEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEl5TnpJek1qVTFOMW9YRFRNMU1USXlOVEl6TWpVMQpOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ2xSVkxiQThpNTJjWUo2bnRRR2lpRnVTRnhVVnphMDA0UDhwM3VwK295SXFPWldJL3llSzY0VU9ueUkKeUF6YzhySXcxeTRjZGYyc1Y4OHhlczUvMzRhallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVuVndjRnRKSHFRV0JuYk9ld3FlcCthUFByTnd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUlZTnFZaHUKNjNpQy9kMzUzQTFTeUhCN2lMWCtSQ1V2R2cza3BtQW1ybG5pQWlFQTdsSURuaElyUUJUMHNQa29aRHFIYWdJTgphZjRsTEhnbllaTUR3d0FVM3JFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpyNlRETEhtRk1aT1RJWXpIWmxNOS9tbTVYZ0l0cWowMEROMzk3Qk9uOEpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFS1ZGVXRzRHlMblp4Z25xZTFBYUtJVzVJWEZSWE5yVFRnL3luZTZuNmpJaW81bFlqL0o0cgpyaFE2ZklqSUROenlzakRYTGh4MS9heFh6ekY2em4vZmhnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
aggregatorCA:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFhZ0F3SUJBZ0lSQUtGQ1hXS24vTnR4eVBuNmxYZjU4R2N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5URXlNamN5TXpJMU5UZGFGdzB6TlRFeU1qVXlNekkxTlRkYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVMwMmptRnFCWU1hSURHeVRQWGNhTjQ2UTRBdCtTLzFob0lqd1QveHhZZUowVDJNeDh1ClRVSWQzNjVKT1dSK2FQS2dWdUkySVZpKzZDNXJOcnBSSnhES28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGTXFxVnowdDVaaERQVTdzcS9hdUxKcWxjMVlkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDCklBdEI4L0hpSS9RakVEVjFiV29DZ1M1TkdtbDNzdUFTRGtUbkZjK2F3TmlEQWlBNzlPeHVJeVl1VFgyVUxvQlQKZWRXbDdEZ0Y0N3htTnM2OTNGcThLeXRGc0E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9EVVVzMklrazhaeGowRDNRQVBLeTlpTCtTSVNaZGhOZjMrdVBqOHNudVRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdE5vNWhhZ1dER2lBeHNrejEzR2plT2tPQUxma3Y5WWFDSThFLzhjV0hpZEU5ak1mTGsxQwpIZCt1U1Rsa2ZtanlvRmJpTmlGWXZ1Z3VhemE2VVNjUXlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
serviceAccount:
|
|
||||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBM0gzV1hzZVU4clpGdzhkaUhIbzB3aWFQdnV3N3VpblJ3MS9xbnB6VldjVGRlWUcrCnJlQ0dMek1vNWlzaHBQT3N2WVd5UEVoZlVyZ01ldTY3cFlTMFNxSmtGcnJtY3lrQUNybHFtaE54ZzVBazZZcTIKOWhPeUphR0tKOVkrdEUzNmFjUjBIWTJ4UEV3K0lKbEdIVUpLNSs2RUsxUXVjYTF5TXpLc0pOM1VrSDVzNXpXeApEbCtSdHJLNklXdEsxYjZ5M213SmtaRTJIYktxUUdXdWxONDZ6M1gzTXJLNk9POVhHNTJ2S3dINFBzdHFHVDc5Ck92dlI3b21yaVF6OUJUclhSYXlqRGp4MEl3NGVTVVJ4QkFsRFlsZDlqd2E3aXd1NHU5bldlazYyRjM3S3VMTE4KYlpWWlQ4WjJqQlJ5WGp5ZXdkTkFpL0Z4bElNSWtSdjE0VVV4M3NEdDhycGh2b2xERDBXVGlRcTNyQkNSUUNrVQpldWpZUmloaDNnQUI4QTN5dGJrZGJSNlgrQ2IrR21NMFVycmgwb2RnWDg0dkdrY1lhR1NrSnRKSEttSlNDUGN3CkJYa29taHd2dDJ4UzVEQTM4aUhPWDc5OTgrQzdJQWpyWnpka3ZLSXZIc1grSklvYTF4d0ZiclJTOUIrNUNDMXQKdnVFd1pvVXlTWEdDOWh0bkd5M1ZjcUdsbFBUQ3NEaForZkpXNGRNazE2cldaVW5uSmM3ek1Fa2pleVJzUERnZAptM215Z0w1RDd2S2w1SnBGNWphM2wzOEt4OC9xKzU3OFY2RllSblhvUElGS25TbGFLNmorKzdmeFZyMFdPNlk4CjRKVnFyUG5LYVVvQ0I0WTFrZGlqSkI1TndVRjVWazdqNVUyWThYRk1vWjRtNGdWQ29jS3laUDlIYXlNQ0F3RUEKQVFLQ0FnQUl3bGovUitkell1bFBsejZmQ2YzSmpyV2NMSTlNM0hkd1R3R25qbXh0VmdSRVhQS2h2cThsOWQ3VQprZmNTc2ZsMVIvZm1MQ3ZaUWVXQkJyWGVvL0J6bkpMa1VrVndZcnNWTWZ0NXBuY1dkbVg0L3lFNGtseTc0UGgzCmo2dkxCdVFCU3FRZ1BtNUJpbmZYWEs5cjN5UFJwZWlMUGh0Z09iYzFNSGlsT0VqRytyYkIwcUMzaFBWcGNCMHoKMGFyVjVlNytKZ1dWU2xML2lBYjZhdSt1QzB3RHpOaG1vN0lCTEFUbVhIUEdmaHdLQnBPdThCRW9SRE81U2EvTwpVSDFHdFdreTQrSlFZUGR1SXhQeDdpMmRMdThGMjVycDBTY25KVzZQeTk0WTJzS2lHVS9kV1lFT3J1V3U1Ui8xCmZhUnplTzRIbmloTXh1a3ZzS3JvOU5ibVBaVDNCUXR2SGl4ZlVNU2pmTXZFcUorNDhpdlA1RTNiYUJHRk5Mc3oKbUZXZW91MFEzVzNTMU50RkQvWnIybFJpT3VrVzhLLytBSm1PL210RWd2NG1UK3pHa05BUGhPT3lQcUlTakgxTAp1WTY3c08wRGlJWmJ1REdmZDQ2YXN3bHBZQis1Z0ZMZGxONDNJcGRxZG5GMFdtbjkybXk3cVluVVhkSkJENnZNCm5TWGJJOTZZOSt6K3V6citTZWMzeWhEckd6a1c1NWJ4VHJqb1FMZ2d6RDRVSWEyMm1ueUFOb3UrZzkyU09RSnEKb0hmWGZoeDdJeEZyM2h2V3ZaVVlYNit6bndUZTBKeVI0cy9NaXZxM2NIVERzV1A2NXBMd3VNQXRMMW1qWHNOcgp4aGhzZDQrNkJYb0R1OGl1V1NFRDlndlFIbVFlN3p3azVEVlNPbXJOTHlZTnZ3Y0U1UUtDQVFFQTYxaWR3VUp0CmJEMUlzQ1RBaVJnaFEvT0oxY3cwcmNqSDhGcGRNaFg1MHc2NUJqcmk5OEU5eDNkK2JpZVA3eXk5cVNMcnN5dzIKSDNteTJXOEZOSHdUUnJCT2NnQVg0cWhSa205Y0tBSlhGS0xVbGY4TlJocWJrR3RyVnMybEdDdXBEZHJxN2RpTApHRGdxY2gxbHpXR1d1UlQyOWZDRXRzZWVyd2NFemtXYTE0MDRYWEIyTi9EK0FHbVB2Mmp2dEFOSml0ekFuL0pWCnQ4NnZLVyttbWlxNVFQNlZHZjFtVmZTMGlSQy9TVzJMditGR3J2ZmRsNHN4WXJONnoweVdZSUZqK2J3aVNYblIKZXhTKzYyUUtleGJCalZwa2gzRnJTNWNsZWJ1ajg0aWVEaVQ1ZDFsTTNhaHlpSjRJYk1IaVJyeG1wSFNDVmkrUQorOHpSbHRwcGI2eko5UUtDQVFFQTc5ZDkwWDhqeFJKV015MUFWTDlrMnN5YjZacG9XN2FHL3AwNTlHVi80dXBNCi9DdTRXVVdOajdWdW1sRmppUFdtT0hhMkxIVnZmVW5DY3M1WTYxRTJVWm9mNXcxLzZ5R2ZwdEtzZ0V5eElUZGMKMFRFV0pPTy9QeVZabEhXR2xJVVNsMlBsTlFuclh6OCsvY29RZklSS29OZmd6K1p5NHdLdFpMWDdpUDBlaGt4YgphWmhNWWF0azNhN0FyQURPRFZiZ1Z3dkdjaER6Vm5oNjc4TzF3a0p0WjJ6TUlrOGF4cy9WR1VMQ0NRdURTV2pICkdsb2IvQlA3TERBdWxKVlN3ajNOY2NLK01ZMnpSSXEwcHNYWkxsVlJicTRZSlhFbUxoRFEzUXhvUklLQVZQM08KWkZWR2lDT3lXU1dJclprZkZHaEkrNlFram1YazJmYmNPTE9QNGUyNXR3S0NBUUVBd3ZKcDR0OXlvcGwxTDZ1Ugo3VDRXdUNIeFNDOWFaNllNc0xVNXc3WmVkZzBaQ09jWWdXQUtHOE9JOEJoSGF6aWxkb2hkczlKb2x0UUphWUZFClQ0Q0R1eWRxSTVhZU1udDQ3cExlUktvRGxpMTNhVFNYdXoxcEpVMUY0ZWFBM2krMFhxeTdzLytPNEtZTnl1ODkKRjg3QnVsaDZaYWt4VmZLdktJN28xVERsSGE1MlJUaFdST3FVaktUa2xRcUluSldvZ3FWdnprNC80UDBOTFlhMQorN2h1TWo5d0pOSTV4ZlBvNUMwQ053SE9KRWlvYzJFUXBtcC9veUhIRmhaNzdqN2dJTXRObjQyUUQ2TlVyc24wCndKZE9CeGdjYy9Gb2pub0thZmNielN5YXVGNjZZcm1QS1lGU05vYXB0ZVU0MloxUWJPT3gzMUNSaVhMVkhsK1gKdlJEbFRRS0NBUUJBNkVpY2taUFVtWW5LZjh5Ukl0cmdlODhXQVR1TTFuRGlKeHF3RVdmeXVRWHNtTWhqSUhlWApGTHJCK0pTL1UvdVAvRkNBNTZjc2VQR3VzRGxRTmNKRmd6aHZCekEvS2ZKUzYyRFR0KzJYMTZ1KzBWSDAyYzNBCkFST2xJY2t5R0hGWGx5bEltVTZoa0RRejZxTmJqMUhEQmFsSm1rd3RNMlJKaFJaMWxFcldmWU9mcUIvRHJ1YTEKTjczY3pycjAwVFlWV0pKei9ESmVqR3g0eHJaQnhFaG5YUUpCcHJiUVp4NThuNXh6WmpJNWc2bWVjQlJ5dTlXVgp0OVJqVWFYNyswM0dJN1hsSXp3SXFLRUxJVEFOWWZtUHduMjJaRkM0MXNRdmpsUUpkbWZVbUh0cW04bGl2b1pkCnFkSzdhRjBJNE5BZmllUjZ4UWlTRkVTMDg2TlV1VWt4QW9JQkFRRG9WL0pJRlNEejl3Z3dneUhhdmdwSnR0UGkKNWZBeEpZaktZbUtsLzdpZUdkZ0pzN1dwR3dxNXlQZFVVRE1yMnNKUDBGWDhEZFJTSktWLzExRzMvaklTL1JyQQpwcDVsS2hGbEFncVBvZ1EvL0IzTVBiNXZiNTBSMExrNGJtVWVYcUVhMkJBSTlmc0R3WEFZbFhsMnJOT0drdEdSCnJZd1BEdHlhbnI1d0grVEtoYjdqODdWN2Z1TWpRcU5SK21TQVJqZXpvRHNQdnJvUHB0d1o0RnBSOTNCUXJqUGoKRWF6Z1UvbHlSRkVCNklISFhvbWFaR1ExYlY1TG85ZTlUZGp6VFpiT2tJMUFsL3B6cWx5WlpzdnU5RnFURUdUbwpRckt6Nm9xeFJyR1lhUVNJbGpydWhPajdiWUVPeGp2VnFEdmNIaGNxV1paN0h5VWNjS2gzNFZReWhCdTQKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
|
||||||
apiServer:
|
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
||||||
admissionControl:
|
|
||||||
- name: PodSecurity
|
|
||||||
configuration:
|
|
||||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
defaults:
|
|
||||||
audit: restricted
|
|
||||||
audit-version: latest
|
|
||||||
enforce: baseline
|
|
||||||
enforce-version: latest
|
|
||||||
warn: restricted
|
|
||||||
warn-version: latest
|
|
||||||
exemptions:
|
|
||||||
namespaces:
|
|
||||||
- kube-system
|
|
||||||
runtimeClasses: []
|
|
||||||
usernames: []
|
|
||||||
kind: PodSecurityConfiguration
|
|
||||||
auditPolicy:
|
|
||||||
apiVersion: audit.k8s.io/v1
|
|
||||||
kind: Policy
|
|
||||||
rules:
|
|
||||||
- level: Metadata
|
|
||||||
controllerManager:
|
|
||||||
image: registry.k8s.io/kube-controller-manager:v1.35.0
|
|
||||||
proxy:
|
|
||||||
image: registry.k8s.io/kube-proxy:v1.35.0
|
|
||||||
scheduler:
|
|
||||||
image: registry.k8s.io/kube-scheduler:v1.35.0
|
|
||||||
discovery:
|
|
||||||
enabled: true
|
|
||||||
registries:
|
|
||||||
kubernetes:
|
|
||||||
disabled: true
|
|
||||||
service: {}
|
|
||||||
etcd:
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRY1hQekZ3N2lYdnlnY2FVMGlUQ3lGekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRJeU56SXpNalUxTjFvWERUTTFNVEl5TlRJek1qVTFOMW93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQlBpREhoWTkzT1FFClpaS2x1L1M3NVBnRmlvNks5SjV1RUZwNk12c3N4NnYzWld6RXJ2clBoNW53QkFqVFFOOUdodTRmQ1dXbXdsQmgKVVhIU09RcHh5OStqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVYnc1N01IV1JvWnYyClZ6UndZNGIyY3c1VGw3c3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdHR1BOZmNzT2M0ajlFblNIbkhRV2dydEQKbEdZWitpZ3JKQnZSWGFSa1FRd0NJUUNOeUlRVU9reWx5U0Vpc1ZyNzFhR3hTRHJ5UFgwZlRuMEdZM25qalpkQQpaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtpazBDeFdObEx6ZWJaY2kwSVYyUHNqOGRoRis5L0Nsb3JXbzAySUdRb1BvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK0lNZUZqM2M1QVJsa3FXNzlMdmsrQVdLam9yMG5tNFFXbm95K3l6SHEvZGxiTVN1K3MrSAptZkFFQ05OQTMwYUc3aDhKWmFiQ1VHRlJjZEk1Q25ITDN3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable
|
|
||||||
|
|
@ -1,433 +0,0 @@
|
||||||
version: v1alpha1 # Indicates the schema used to decode the contents.
|
|
||||||
debug: false # Enable verbose logging to the console.
|
|
||||||
persist: true
|
|
||||||
# Provides machine specific configuration options.
|
|
||||||
machine:
|
|
||||||
type: worker # Defines the role of the machine within the cluster.
|
|
||||||
token: crmyjb.dxygte3bpfb9bhbx # The `token` is used by a machine to join the PKI of the cluster.
|
|
||||||
# The root certificate authority of the PKI.
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJCTXQvK0c0T3h2dVJvZVhIZWVvaitNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNREV5TWpBeE16bGFGdzB6TlRFeU16QXlNakF4TXpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBZUZGeHM1ZjhlcEg5RFJ3WlZPVTBlM3NLbEdYQ3ZlbDZqU2pqCjRzOEp0WWVqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVNHluSml6aUYwbFFJUUVISwpnUzB3YmtyNmNKd3dCUVlESzJWd0EwRUFtdjZMNVRpem9YaTk0NXY2aU4rT2w4SDdHM0dCOFFyVXhMYnF5Nk1SCkdnNUtsZkVNYUhQTGlNMXVPaTNsd2FnWndhd2wvTDFVckNGdDhOdmNHQjZkQ2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
# Extra certificate subject alternative names for the machine's certificate.
|
|
||||||
certSANs: []
|
|
||||||
# # Uncomment this to enable SANs.
|
|
||||||
# - 10.0.0.10
|
|
||||||
# - 172.16.0.10
|
|
||||||
# - 192.168.0.10
|
|
||||||
|
|
||||||
# Used to provide additional options to the kubelet.
|
|
||||||
kubelet:
|
|
||||||
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
|
||||||
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
|
||||||
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
|
||||||
|
|
||||||
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
|
||||||
# clusterDNS:
|
|
||||||
# - 10.96.0.10
|
|
||||||
# - 169.254.2.53
|
|
||||||
|
|
||||||
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
|
||||||
# extraArgs:
|
|
||||||
# key: value
|
|
||||||
|
|
||||||
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
|
||||||
# extraMounts:
|
|
||||||
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
|
||||||
# type: bind # Type specifies the mount kind.
|
|
||||||
# source: /var/lib/example # Source specifies the source path of the mount.
|
|
||||||
# # Options are fstab style mount options.
|
|
||||||
# options:
|
|
||||||
# - bind
|
|
||||||
# - rshared
|
|
||||||
# - rw
|
|
||||||
|
|
||||||
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
|
||||||
# extraConfig:
|
|
||||||
# serverTLSBootstrap: true
|
|
||||||
|
|
||||||
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
|
||||||
# credentialProviderConfig:
|
|
||||||
# apiVersion: kubelet.config.k8s.io/v1
|
|
||||||
# kind: CredentialProviderConfig
|
|
||||||
# providers:
|
|
||||||
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
|
||||||
# defaultCacheDuration: 12h
|
|
||||||
# matchImages:
|
|
||||||
# - '*.dkr.ecr.*.amazonaws.com'
|
|
||||||
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
|
||||||
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
|
||||||
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
|
||||||
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
|
||||||
# name: ecr-credential-provider
|
|
||||||
|
|
||||||
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
|
||||||
# nodeIP:
|
|
||||||
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
|
||||||
# validSubnets:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
# - '!10.0.0.3/32'
|
|
||||||
# - fdc7::/16
|
|
||||||
# Provides machine specific network configuration options.
|
|
||||||
network: {}
|
|
||||||
# # Configures KubeSpan feature.
|
|
||||||
# kubespan:
|
|
||||||
# enabled: true # Enable the KubeSpan feature.
|
|
||||||
|
|
||||||
# Used to provide instructions for installations.
|
|
||||||
install:
|
|
||||||
disk: /dev/sda # The disk used for installations.
|
|
||||||
image: ghcr.io/siderolabs/installer:v1.12.0 # Allows for supplying the image used to perform the installation.
|
|
||||||
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
|
||||||
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
|
||||||
|
|
||||||
# # Look up disk using disk attributes like model, size, serial and others.
|
|
||||||
# diskSelector:
|
|
||||||
# size: 4GB # Disk size.
|
|
||||||
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
|
||||||
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
|
||||||
registries: {}
|
|
||||||
# Features describe individual Talos features that can be switched on or off.
|
|
||||||
features:
|
|
||||||
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
|
||||||
# KubePrism - local proxy/load balancer on defined port that will distribute
|
|
||||||
kubePrism:
|
|
||||||
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
|
||||||
port: 7445 # KubePrism port.
|
|
||||||
# Configures host DNS caching resolver.
|
|
||||||
hostDNS:
|
|
||||||
enabled: true # Enable host DNS caching resolver.
|
|
||||||
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
|
||||||
|
|
||||||
# # Configure Talos API access from Kubernetes pods.
|
|
||||||
# kubernetesTalosAPIAccess:
|
|
||||||
# enabled: true # Enable Talos API access from Kubernetes pods.
|
|
||||||
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
|
||||||
# allowedRoles:
|
|
||||||
# - os:reader
|
|
||||||
# # The list of Kubernetes namespaces Talos API access is available from.
|
|
||||||
# allowedKubernetesNamespaces:
|
|
||||||
# - kube-system
|
|
||||||
|
|
||||||
# # Provides machine specific control plane configuration options.
|
|
||||||
|
|
||||||
# # ControlPlane definition example.
|
|
||||||
# controlPlane:
|
|
||||||
# # Controller manager machine specific configuration options.
|
|
||||||
# controllerManager:
|
|
||||||
# disabled: false # Disable kube-controller-manager on the node.
|
|
||||||
# # Scheduler machine specific configuration options.
|
|
||||||
# scheduler:
|
|
||||||
# disabled: true # Disable kube-scheduler on the node.
|
|
||||||
|
|
||||||
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
|
||||||
|
|
||||||
# # nginx static pod.
|
|
||||||
# pods:
|
|
||||||
# - apiVersion: v1
|
|
||||||
# kind: pod
|
|
||||||
# metadata:
|
|
||||||
# name: nginx
|
|
||||||
# spec:
|
|
||||||
# containers:
|
|
||||||
# - image: nginx
|
|
||||||
# name: nginx
|
|
||||||
|
|
||||||
# # Allows the addition of user specified files.
|
|
||||||
|
|
||||||
# # MachineFiles usage example.
|
|
||||||
# files:
|
|
||||||
# - content: '...' # The contents of the file.
|
|
||||||
# permissions: 0o666 # The file's permissions in octal.
|
|
||||||
# path: /tmp/file.txt # The path of the file.
|
|
||||||
# op: append # The operation to use
|
|
||||||
|
|
||||||
# # The `env` field allows for the addition of environment variables.
|
|
||||||
|
|
||||||
# # Environment variables definition examples.
|
|
||||||
# env:
|
|
||||||
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
|
||||||
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
|
||||||
# https_proxy: http://SERVER:PORT/
|
|
||||||
# env:
|
|
||||||
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
|
||||||
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
|
||||||
# env:
|
|
||||||
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
|
||||||
|
|
||||||
# # Used to configure the machine's sysctls.
|
|
||||||
|
|
||||||
# # MachineSysctls usage example.
|
|
||||||
# sysctls:
|
|
||||||
# kernel.domainname: talos.dev
|
|
||||||
# net.ipv4.ip_forward: "0"
|
|
||||||
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
|
||||||
|
|
||||||
# # Used to configure the machine's sysfs.
|
|
||||||
|
|
||||||
# # MachineSysfs usage example.
|
|
||||||
# sysfs:
|
|
||||||
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
|
||||||
|
|
||||||
# # Configures the udev system.
|
|
||||||
# udev:
|
|
||||||
# # List of udev rules to apply to the udev system
|
|
||||||
# rules:
|
|
||||||
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
|
||||||
|
|
||||||
# # Configures the logging system.
|
|
||||||
# logging:
|
|
||||||
# # Logging destination.
|
|
||||||
# destinations:
|
|
||||||
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
|
||||||
# format: json_lines # Logs format.
|
|
||||||
|
|
||||||
# # Configures the kernel.
|
|
||||||
# kernel:
|
|
||||||
# # Kernel modules to load.
|
|
||||||
# modules:
|
|
||||||
# - name: btrfs # Module name.
|
|
||||||
|
|
||||||
# # Configures the seccomp profiles for the machine.
|
|
||||||
# seccompProfiles:
|
|
||||||
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
|
||||||
# # The `value` field is used to provide the seccomp profile.
|
|
||||||
# value:
|
|
||||||
# defaultAction: SCMP_ACT_LOG
|
|
||||||
|
|
||||||
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
|
||||||
|
|
||||||
# # override default open file limit
|
|
||||||
# baseRuntimeSpecOverrides:
|
|
||||||
# process:
|
|
||||||
# rlimits:
|
|
||||||
# - hard: 1024
|
|
||||||
# soft: 1024
|
|
||||||
# type: RLIMIT_NOFILE
|
|
||||||
|
|
||||||
# # Configures the node labels for the machine.
|
|
||||||
|
|
||||||
# # node labels example.
|
|
||||||
# nodeLabels:
|
|
||||||
# exampleLabel: exampleLabelValue
|
|
||||||
|
|
||||||
# # Configures the node annotations for the machine.
|
|
||||||
|
|
||||||
# # node annotations example.
|
|
||||||
# nodeAnnotations:
|
|
||||||
# customer.io/rack: r13a25
|
|
||||||
|
|
||||||
# # Configures the node taints for the machine. Effect is optional.
|
|
||||||
|
|
||||||
# # node taints example.
|
|
||||||
# nodeTaints:
|
|
||||||
# exampleTaint: exampleTaintValue:NoSchedule
|
|
||||||
# Provides cluster specific configuration options.
|
|
||||||
cluster:
|
|
||||||
id: mTc4onTNw_N-wtS8vazkBogBrVccq9ESY6XEUgLP3NQ= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
|
||||||
secret: c9Yv3y6djM9jG3Y7gN1lhmo35Fh0ap/eA4asTicPZEQ= # Shared secret of cluster (base64 encoded random 32 bytes).
|
|
||||||
# Provides control plane specific configuration options.
|
|
||||||
controlPlane:
|
|
||||||
endpoint: https://10.0.0.101:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
|
||||||
clusterName: vntx # Configures the cluster's name.
|
|
||||||
# Provides cluster specific network configuration options.
|
|
||||||
network:
|
|
||||||
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
|
||||||
# The pod subnet CIDR.
|
|
||||||
podSubnets:
|
|
||||||
- 10.244.0.0/16
|
|
||||||
# The service subnet CIDR.
|
|
||||||
serviceSubnets:
|
|
||||||
- 10.96.0.0/12
|
|
||||||
|
|
||||||
# # The CNI used.
|
|
||||||
# cni:
|
|
||||||
# name: custom # Name of CNI to use.
|
|
||||||
# # URLs containing manifests to apply for the CNI.
|
|
||||||
# urls:
|
|
||||||
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
|
||||||
token: kcout8.f7gf8hxd6jqvkiyb # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
|
||||||
# The base64 encoded root certificate authority used by Kubernetes.
|
|
||||||
ca:
|
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQU9LdVVqbjZ6UFR6WUdLLysrb0VtelF3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TURFeU1qQXhNemxhRncwek5URXlNekF5TWpBeApNemxhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVFSa0swVkNNSjIzeEJ3dTNlMWkySlhwUGVEcVdFOEJqZHR4dDMyNHBZY1B3Y2ljM0k0ZGFkejVRMHYKYU9aZ2FDb1NNanRYNWJ1ZCtQd0lLN1VGK0JNNW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTmg0MGZFV2lpa08vWXpqL3poNmJJQ1M3ODc5TUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUdNcVRGNjAKZlhqcU1zYUREMFEvU1VVWjhjdkZHazJ2aXRPOFlSdFk4QnZGQWlFQXpqTTY4cmRPSHMxb0wrK01HRmJvN1BzdgpVWTdya2xmbkJ6bjBDYmRsYTBFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
|
||||||
key: ""
|
|
||||||
# Configures cluster member discovery.
|
|
||||||
discovery:
|
|
||||||
enabled: true # Enable the cluster membership discovery feature.
|
|
||||||
# Configure registries used for cluster member discovery.
|
|
||||||
registries:
|
|
||||||
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
|
||||||
kubernetes:
|
|
||||||
disabled: true # Disable Kubernetes discovery registry.
|
|
||||||
# Service registry is using an external service to push and pull information about cluster members.
|
|
||||||
service: {}
|
|
||||||
# # External service endpoint.
|
|
||||||
# endpoint: https://discovery.talos.dev/
|
|
||||||
|
|
||||||
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
|
||||||
|
|
||||||
# # Decryption secret example (do not use in production!).
|
|
||||||
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
|
||||||
|
|
||||||
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
|
||||||
|
|
||||||
# # Decryption secret example (do not use in production!).
|
|
||||||
# secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
|
||||||
|
|
||||||
# # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
|
||||||
|
|
||||||
# # AggregatorCA example.
|
|
||||||
# aggregatorCA:
|
|
||||||
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
|
||||||
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
|
||||||
|
|
||||||
# # The base64 encoded private key for service account token generation.
|
|
||||||
|
|
||||||
# # AggregatorCA example.
|
|
||||||
# serviceAccount:
|
|
||||||
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
|
||||||
|
|
||||||
# # API server specific configuration options.
|
|
||||||
# apiServer:
|
|
||||||
# image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
|
||||||
# # Extra arguments to supply to the API server.
|
|
||||||
# extraArgs:
|
|
||||||
# feature-gates: ServerSideApply=true
|
|
||||||
# http2-max-streams-per-connection: "32"
|
|
||||||
# # Extra certificate subject alternative names for the API server's certificate.
|
|
||||||
# certSANs:
|
|
||||||
# - 1.2.3.4
|
|
||||||
# - 4.5.6.7
|
|
||||||
# # Configure the API server admission plugins.
|
|
||||||
# admissionControl:
|
|
||||||
# - name: PodSecurity # Name is the name of the admission controller.
|
|
||||||
# # Configuration is an embedded configuration object to be used as the plugin's
|
|
||||||
# configuration:
|
|
||||||
# apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
||||||
# defaults:
|
|
||||||
# audit: restricted
|
|
||||||
# audit-version: latest
|
|
||||||
# enforce: baseline
|
|
||||||
# enforce-version: latest
|
|
||||||
# warn: restricted
|
|
||||||
# warn-version: latest
|
|
||||||
# exemptions:
|
|
||||||
# namespaces:
|
|
||||||
# - kube-system
|
|
||||||
# runtimeClasses: []
|
|
||||||
# usernames: []
|
|
||||||
# kind: PodSecurityConfiguration
|
|
||||||
# # Configure the API server audit policy.
|
|
||||||
# auditPolicy:
|
|
||||||
# apiVersion: audit.k8s.io/v1
|
|
||||||
# kind: Policy
|
|
||||||
# rules:
|
|
||||||
# - level: Metadata
|
|
||||||
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
|
||||||
# authorizationConfig:
|
|
||||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
|
||||||
# name: webhook # Name is used to describe the authorizer.
|
|
||||||
# # webhook is the configuration for the webhook authorizer.
|
|
||||||
# webhook:
|
|
||||||
# connectionInfo:
|
|
||||||
# type: InClusterConfig
|
|
||||||
# failurePolicy: Deny
|
|
||||||
# matchConditionSubjectAccessReviewVersion: v1
|
|
||||||
# matchConditions:
|
|
||||||
# - expression: has(request.resourceAttributes)
|
|
||||||
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
|
||||||
# subjectAccessReviewVersion: v1
|
|
||||||
# timeout: 3s
|
|
||||||
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
|
||||||
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
|
||||||
# # webhook is the configuration for the webhook authorizer.
|
|
||||||
# webhook:
|
|
||||||
# connectionInfo:
|
|
||||||
# type: InClusterConfig
|
|
||||||
# failurePolicy: NoOpinion
|
|
||||||
# matchConditionSubjectAccessReviewVersion: v1
|
|
||||||
# subjectAccessReviewVersion: v1
|
|
||||||
# timeout: 3s
|
|
||||||
|
|
||||||
# # Controller manager server specific configuration options.
|
|
||||||
# controllerManager:
|
|
||||||
# image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
|
||||||
# # Extra arguments to supply to the controller manager.
|
|
||||||
# extraArgs:
|
|
||||||
# feature-gates: ServerSideApply=true
|
|
||||||
|
|
||||||
# # Kube-proxy server-specific configuration options
|
|
||||||
# proxy:
|
|
||||||
# disabled: false # Disable kube-proxy deployment on cluster bootstrap.
|
|
||||||
# image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
|
||||||
# mode: ipvs # proxy mode of kube-proxy.
|
|
||||||
# # Extra arguments to supply to kube-proxy.
|
|
||||||
# extraArgs:
|
|
||||||
# proxy-mode: iptables
|
|
||||||
|
|
||||||
# # Scheduler server specific configuration options.
|
|
||||||
# scheduler:
|
|
||||||
# image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
|
||||||
# # Extra arguments to supply to the scheduler.
|
|
||||||
# extraArgs:
|
|
||||||
# feature-gates: AllBeta=true
|
|
||||||
|
|
||||||
# # Etcd specific configuration options.
|
|
||||||
# etcd:
|
|
||||||
# image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service.
|
|
||||||
# # The `ca` is the root certificate authority of the PKI.
|
|
||||||
# ca:
|
|
||||||
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
|
||||||
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
|
||||||
# # Extra arguments to supply to etcd.
|
|
||||||
# extraArgs:
|
|
||||||
# election-timeout: "5000"
|
|
||||||
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
|
||||||
# advertisedSubnets:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
|
|
||||||
# # Core DNS specific configuration options.
|
|
||||||
# coreDNS:
|
|
||||||
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
|
||||||
|
|
||||||
# # External cloud provider configuration.
|
|
||||||
# externalCloudProvider:
|
|
||||||
# enabled: true # Enable external cloud provider.
|
|
||||||
# # A list of urls that point to additional manifests for an external cloud provider.
|
|
||||||
# manifests:
|
|
||||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
|
||||||
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
|
||||||
|
|
||||||
# # A list of urls that point to additional manifests.
|
|
||||||
# extraManifests:
|
|
||||||
# - https://www.example.com/manifest1.yaml
|
|
||||||
# - https://www.example.com/manifest2.yaml
|
|
||||||
|
|
||||||
# # A map of key value pairs that will be added while fetching the extraManifests.
|
|
||||||
# extraManifestHeaders:
|
|
||||||
# Token: "1234567"
|
|
||||||
# X-ExtraInfo: info
|
|
||||||
|
|
||||||
# # A list of inline Kubernetes manifests.
|
|
||||||
# inlineManifests:
|
|
||||||
# - name: namespace-ci # Name of the manifest.
|
|
||||||
# contents: |- # Manifest contents as a string.
|
|
||||||
# apiVersion: v1
|
|
||||||
# kind: Namespace
|
|
||||||
# metadata:
|
|
||||||
# name: ci
|
|
||||||
|
|
||||||
# # Settings for admin kubeconfig generation.
|
|
||||||
# adminKubeconfig:
|
|
||||||
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
|
||||||
|
|
||||||
# # Allows running workload on control-plane nodes.
|
|
||||||
# allowSchedulingOnControlPlanes: true
|
|
||||||
---
|
|
||||||
apiVersion: v1alpha1
|
|
||||||
kind: HostnameConfig
|
|
||||||
auto: stable # A method to automatically generate a hostname for the machine.
|
|
||||||
|
|
||||||
# # A static hostname to set for the machine.
|
|
||||||
# hostname: controlplane1
|
|
||||||
# hostname: controlplane1.example.org
|
|
||||||
Loading…
Add table
Reference in a new issue