From b951c77015dd73c2d2c53a837df852d859be9294 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Fri, 16 Jan 2026 09:25:46 -0600 Subject: [PATCH] fix vntx cnames --- .../group_vars/bind9_servers/mcintire.me.yml | 2 + ansible/group_vars/bind9_servers/vntx.net.yml | 32 ++ cluster/ceph-csi/00-namespace.yaml | 2 + cluster/ceph-csi/talosconfig | 2 + cluster/pangolin-newt.yaml | 6 +- talos/CLAUDE.md | 313 +++++++++++++ talos/configs/talos-cp1.yaml | 407 +++++++++++++++++ talos/configs/talos-cp2.yaml | 407 +++++++++++++++++ talos/configs/talos-cp3.yaml | 407 +++++++++++++++++ talos/configs/talos-worker1.yaml | 432 ++++++++++++++++++ talos/configs/talos-worker2.yaml | 432 ++++++++++++++++++ talos/configs/talos-worker3.yaml | 432 ++++++++++++++++++ talos/controlplane.yaml | 28 +- talos/secrets.yaml.backup | 23 + talos/talosconfig.backup | 12 + talos/worker.yaml | 12 +- talosconfig | 2 + terraform/talos_vms.tf | 78 ++-- terraform/variables.tf | 2 +- 19 files changed, 2978 insertions(+), 53 deletions(-) create mode 100644 cluster/ceph-csi/talosconfig create mode 100644 talos/CLAUDE.md create mode 100644 talos/configs/talos-cp1.yaml create mode 100644 talos/configs/talos-cp2.yaml create mode 100644 talos/configs/talos-cp3.yaml create mode 100644 talos/configs/talos-worker1.yaml create mode 100644 talos/configs/talos-worker2.yaml create mode 100644 talos/configs/talos-worker3.yaml create mode 100644 talos/secrets.yaml.backup create mode 100644 talos/talosconfig.backup create mode 100644 talosconfig diff --git a/ansible/group_vars/bind9_servers/mcintire.me.yml b/ansible/group_vars/bind9_servers/mcintire.me.yml index b77cb9c..1bbd97b 100644 --- a/ansible/group_vars/bind9_servers/mcintire.me.yml +++ b/ansible/group_vars/bind9_servers/mcintire.me.yml @@ -18,6 +18,8 @@ mcintire_me_zone: ip: 107.174.178.20 - name: photos ip: 204.110.191.8 + - name: "pangolin" + ip: 172.245.56.83 other_name_servers: - autodiscover.mcintire.me. IN CNAME mail.w5isp.com. - autoconfig.mcintire.me. IN CNAME mail.w5isp.com. diff --git a/ansible/group_vars/bind9_servers/vntx.net.yml b/ansible/group_vars/bind9_servers/vntx.net.yml index 4d29b18..a0a78c2 100644 --- a/ansible/group_vars/bind9_servers/vntx.net.yml +++ b/ansible/group_vars/bind9_servers/vntx.net.yml @@ -72,6 +72,38 @@ vntx_net_zone: ip: 204.110.191.224 - name: dns ip: 204.110.191.193 + other_name_servers: + - mg.vntx.net. IN CNAME mailgun.org. + - email.mg.vntx.net. IN CNAME mailgun.org. + - mail.speedtest.vntx.net. IN CNAME mail.speedtest.vntx.net.s2.mailersendapp.com. + - status.vntx.net. IN CNAME stats.uptimerobot.com. + - ntp.vntx.net. IN CNAME 0.us.pool.ntp.org. + - iptrack.vntx.net. IN CNAME dokku.w5isp.com. + - _83337805c305955c6823504cc5e6ca29.vntx.net. IN CNAME _baf97cdcc7b6458fa5719e4261e9932f.sdgjtdhdhz.acm-validations.aws. + - 177982.vntx.net. IN CNAME sendgrid.net. + - 4809fce066c3da4d14197c7276ba083f.irc.vntx.net. IN CNAME b58bf151af520d34d8fad99d05274cb536893031.comodoca.com. + - 9p83fpanfdgs8xdgcnzd.vntx.net. IN CNAME verify.squarespace.com. + - activate.vntx.net. IN CNAME verona-networks-checkout.gaiia-consumer.com. + - autodiscover.o365.vntx.net. IN CNAME autodiscover.outlook.com. + - autodiscover.vntx.net. IN CNAME autodiscover.outlook.com. + - em924886.vntx.net. IN CNAME return.smtp2go.net. + - em9279.vntx.net. IN CNAME u177982.wl233.sendgrid.net. + - email.vntx.net. IN CNAME mandrillapp.com. + - enterpriseenrollment.o365.vntx.net. IN CNAME enterpriseenrollment.manage.microsoft.com. + - enterpriseregistration.o365.vntx.net. IN CNAME enterpriseregistration.windows.net. + - link.vntx.net. IN CNAME track.smtp2go.net. + - lyncdiscover.o365.vntx.net. IN CNAME webdir.online.lync.com. + - mte1._domainkey.vntx.net. IN CNAME dkim1.mandrillapp.com. + - mte2._domainkey.vntx.net. IN CNAME dkim2.mandrillapp.com. + - portal.vntx.net. IN CNAME verona-networks-clientportal.gaiia-consumer.com. + - s1._domainkey.vntx.net. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net. + - s2._domainkey.vntx.net. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net. + - s924886._domainkey.vntx.net. IN CNAME dkim.smtp2go.net. + - sip.o365.vntx.net. IN CNAME sipdir.online.lync.com. + - uptime.vntx.net. IN CNAME page.updown.io. + - url62.vntx.net. IN CNAME sendgrid.net. + - url9812.vntx.net. IN CNAME sendgrid.net. + - www.vntx.net. IN CNAME ext-cust.squarespace.com. text: - name: "@" text: '"v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"' diff --git a/cluster/ceph-csi/00-namespace.yaml b/cluster/ceph-csi/00-namespace.yaml index def9c90..3e257ce 100644 --- a/cluster/ceph-csi/00-namespace.yaml +++ b/cluster/ceph-csi/00-namespace.yaml @@ -2,3 +2,5 @@ apiVersion: v1 kind: Namespace metadata: name: ceph-csi-rbd + labels: + pod-security.kubernetes.io/enforce: privileged diff --git a/cluster/ceph-csi/talosconfig b/cluster/ceph-csi/talosconfig new file mode 100644 index 0000000..e35e5db --- /dev/null +++ b/cluster/ceph-csi/talosconfig @@ -0,0 +1,2 @@ +context: "" +contexts: {} diff --git a/cluster/pangolin-newt.yaml b/cluster/pangolin-newt.yaml index daf5467..306d107 100644 --- a/cluster/pangolin-newt.yaml +++ b/cluster/pangolin-newt.yaml @@ -3,6 +3,8 @@ apiVersion: v1 kind: Namespace metadata: name: pangolin + labels: + pod-security.kubernetes.io/enforce: privileged --- apiVersion: v1 kind: Secret @@ -11,8 +13,8 @@ metadata: namespace: pangolin type: Opaque stringData: - NEWT_ID: "mz1ixml2gg3vezk" - NEWT_SECRET: "0zwoklb1esw269r2pyf4x65dn0llgl8nnsdssmnzqbkwkv00" + NEWT_ID: "ouni3kkg688rt5q" + NEWT_SECRET: "i2rzel1tohf96bq8o8jmy6ky7kn9euz01f70uerrarc61hlo" PANGOLIN_ENDPOINT: "https://pangolin.w5isp.com" --- apiVersion: apps/v1 diff --git a/talos/CLAUDE.md b/talos/CLAUDE.md new file mode 100644 index 0000000..3f84e94 --- /dev/null +++ b/talos/CLAUDE.md @@ -0,0 +1,313 @@ +# Talos Cluster Setup Guide + +This document contains notes on how the Talos home cluster was created and how to recreate it in the future. + +## Cluster Information + +- **Cluster Name**: home-cluster +- **Kubernetes Version**: v1.35.0 +- **Talos Version**: v1.12.1 +- **Control Plane Nodes**: 3 (10.0.15.1-3) +- **Worker Nodes**: 3 (10.0.15.4-6) +- **API Endpoint**: https://10.0.15.1:6443 + +## Node Details + +| Hostname | Role | IP | Proxmox Node | VMID | MAC Address | +|----------|------|-----|--------------|------|-------------| +| talos-cp1 | Control Plane | 10.0.15.1 | node1 | 200 | BC:24:11:9B:48:92 | +| talos-cp2 | Control Plane | 10.0.15.2 | node2 | 201 | BC:24:11:62:7B:3F | +| talos-cp3 | Control Plane | 10.0.15.3 | node3 | 202 | BC:24:11:D4:2F:ED | +| talos-worker1 | Worker | 10.0.15.4 | node1 | 210 | BC:24:11:43:3F:FF | +| talos-worker2 | Worker | 10.0.15.5 | node2 | 211 | BC:24:11:62:C4:8F | +| talos-worker3 | Worker | 10.0.15.6 | node3 | 212 | BC:24:11:3F:8E:1A | + +## Prerequisites + +- Proxmox home cluster with nodes: node1, node2, node3 (10.0.15.101-103) +- Talos Linux template at VMID 9001 on node1 +- DHCP static leases configured for all MAC addresses above +- Terraform/OpenTofu configured with Proxmox provider +- talosctl CLI installed + +## Complete Cluster Creation Process + +### 1. Generate New Cluster Secrets + +```bash +cd /Users/graham/dev/infra/talos +talosctl gen secrets -o secrets.yaml --force +``` + +### 2. Generate Node-Specific Configurations + +Each node needs a configuration with its specific hostname. Use patch files to set hostnames: + +```bash +mkdir -p configs + +# Generate control plane configs +for i in 1 2 3; do + cat > /tmp/cp${i}-patch.yaml < /tmp/w${i}-patch.yaml < /dev/null 2>&1 && echo "up" || echo "down" +done +``` + +### 6. Apply Talos Configuration to All Nodes + +```bash +talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.1 --file configs/talos-cp1.yaml --insecure +talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.2 --file configs/talos-cp2.yaml --insecure +talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.3 --file configs/talos-cp3.yaml --insecure +talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.4 --file configs/talos-worker1.yaml --insecure +talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.5 --file configs/talos-worker2.yaml --insecure +talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.6 --file configs/talos-worker3.yaml --insecure +``` + +### 7. Bootstrap the Cluster + +```bash +# Set talosctl endpoints +talosctl --talosconfig talosconfig config endpoint 10.0.15.1 10.0.15.2 10.0.15.3 + +# Bootstrap Kubernetes on the first control plane node +talosctl --talosconfig talosconfig bootstrap --nodes 10.0.15.1 +``` + +### 8. Retrieve Kubeconfig + +```bash +# Wait for cluster to initialize (about 60 seconds) +sleep 60 + +# Retrieve and merge kubeconfig +talosctl --talosconfig talosconfig kubeconfig --nodes 10.0.15.1 --force + +# Switch to the cluster +kubectl config use-context admin@home-cluster +``` + +### 9. Verify Cluster + +```bash +# Wait for all nodes to be Ready +kubectl get nodes -o wide + +# Check all system pods are running +kubectl get pods -A + +# Verify node names +kubectl get nodes +# Expected output: +# NAME STATUS ROLES AGE VERSION +# talos-cp1 Ready control-plane ... v1.35.0 +# talos-cp2 Ready control-plane ... v1.35.0 +# talos-cp3 Ready control-plane ... v1.35.0 +# talos-worker1 Ready ... v1.35.0 +# talos-worker2 Ready ... v1.35.0 +# talos-worker3 Ready ... v1.35.0 +``` + +## Important Files + +- `secrets.yaml` - Cluster secrets (CRITICAL - keep secure and backed up!) +- `talosconfig` - Talosctl client configuration +- `configs/talos-cp*.yaml` - Control plane node configurations +- `configs/talos-worker*.yaml` - Worker node configurations +- `~/.kube/config` - Contains merged kubeconfig with admin@home-cluster context + +## Key Lessons Learned + +1. **Hostname Configuration**: Talos uses two places for hostname: + - `machine.network.hostname` (for machine config) + - `HostnameConfig` document (v1alpha1 config) + - Only ONE should be set. Use `HostnameConfig` document with `hostname:` field for static names. + +2. **Template Considerations**: The Talos template (VMID 9001) has `HostnameConfig.auto: stable` which auto-generates hostnames. When applying custom configs, this needs to be overridden. + +3. **Terraform Environment**: Always `source .envrc` before running terraform commands to load backend configuration. + +4. **Bootstrap Process**: Bootstrap must happen AFTER all control plane nodes have configs applied, but BEFORE retrieving kubeconfig. + +5. **Node Naming**: Kubernetes node names come from the Talos hostname configuration, not VM names in Proxmox. + +## Troubleshooting + +### Nodes won't accept new config + +If seeing "static hostname is already set" error: +- Ensure only `HostnameConfig` document has hostname, not `machine.network.hostname` +- Use `--mode=reboot` or recreate the VM entirely + +### Can't connect with talosctl + +Set endpoints explicitly: +```bash +talosctl --talosconfig talosconfig config endpoint 10.0.15.1 10.0.15.2 10.0.15.3 +``` + +### Nodes not appearing in kubectl + +Wait 1-2 minutes after bootstrap. Check: +```bash +talosctl --talosconfig talosconfig service --nodes 10.0.15.1 +# Look for kubelet, etcd, apid as "Running" +``` + +## Networking + +- **CNI**: Flannel (deployed automatically) +- **Service CIDR**: 10.96.0.0/12 +- **Pod CIDR**: 10.244.0.0/16 +- **DNS**: CoreDNS (cluster.local domain) + +## Storage + +Nodes use Proxmox Ceph for VM disks. For Kubernetes persistent storage, deploy: +- Ceph CSI driver (to use Proxmox Ceph directly) +- Or Longhorn for cluster-managed storage + +## Maintenance + +### Adding a Node + +1. Add VM definition to `terraform/talos_vms.tf` +2. Run `tofu apply` +3. Generate config with appropriate hostname +4. Apply config: `talosctl apply-config --nodes --file .yaml --insecure` + +### Upgrading Talos + +```bash +talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.X.Y +``` + +### Upgrading Kubernetes + +```bash +talosctl --talosconfig talosconfig upgrade-k8s --to 1.XX.0 +``` + +## Backup Strategy + +Essential files to backup: +1. `secrets.yaml` - Cannot recover cluster without this +2. `talosconfig` - Required for talosctl access +3. Node configs in `configs/` directory +4. Terraform state (stored in GitLab HTTP backend) + +Store securely in password manager or encrypted backup location. diff --git a/talos/configs/talos-cp1.yaml b/talos/configs/talos-cp1.yaml new file mode 100644 index 0000000..653f1f7 --- /dev/null +++ b/talos/configs/talos-cp1.yaml @@ -0,0 +1,407 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: controlplane # Defines the role of the machine within the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + # Used to provide instructions for installations. + install: + disk: /dev/sda # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation. + extensions: + - image: ghcr.io/siderolabs/tailscale:1.82.1 + wipe: false # Indicates if the installation disk should be wiped at installation time. + grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. + extraKernelArgs: + - console=tty0 + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + # Features describe individual Talos features that can be switched on or off. + features: + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + # Configures the node labels for the machine. + nodeLabels: + node.kubernetes.io/exclude-from-external-load-balancers: "" + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: btrfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home-cluster # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + aggregatorCA: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded private key for service account token generation. + serviceAccount: + key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K + # API server specific configuration options. + apiServer: + image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. + # Configure the API server admission plugins. + admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration + # Configure the API server audit policy. + auditPolicy: + apiVersion: audit.k8s.io/v1 + kind: Policy + rules: + - level: Metadata + + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + # Controller manager server specific configuration options. + controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. + # Kube-proxy server-specific configuration options + proxy: + image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false + # Scheduler server specific configuration options. + scheduler: + image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + # Etcd specific configuration options. + etcd: + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + + # # The container image used to create the etcd service. + # image: registry.k8s.io/etcd:v3.6.7 + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + # A list of urls that point to additional manifests. + extraManifests: [] + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # A list of inline Kubernetes manifests. + inlineManifests: [] + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-cp1 +# hostname: controlplane1.example.org +--- +apiVersion: v1alpha1 +kind: ExtensionServiceConfig +name: tailscale # Name of the extension service. +# The environment for the extension service. +environment: + - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-cp2.yaml b/talos/configs/talos-cp2.yaml new file mode 100644 index 0000000..a0dc76f --- /dev/null +++ b/talos/configs/talos-cp2.yaml @@ -0,0 +1,407 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: controlplane # Defines the role of the machine within the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + # Used to provide instructions for installations. + install: + disk: /dev/sda # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation. + extensions: + - image: ghcr.io/siderolabs/tailscale:1.82.1 + wipe: false # Indicates if the installation disk should be wiped at installation time. + grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. + extraKernelArgs: + - console=tty0 + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + # Features describe individual Talos features that can be switched on or off. + features: + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + # Configures the node labels for the machine. + nodeLabels: + node.kubernetes.io/exclude-from-external-load-balancers: "" + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: btrfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home-cluster # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + aggregatorCA: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded private key for service account token generation. + serviceAccount: + key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K + # API server specific configuration options. + apiServer: + image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. + # Configure the API server admission plugins. + admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration + # Configure the API server audit policy. + auditPolicy: + apiVersion: audit.k8s.io/v1 + kind: Policy + rules: + - level: Metadata + + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + # Controller manager server specific configuration options. + controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. + # Kube-proxy server-specific configuration options + proxy: + image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false + # Scheduler server specific configuration options. + scheduler: + image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + # Etcd specific configuration options. + etcd: + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + + # # The container image used to create the etcd service. + # image: registry.k8s.io/etcd:v3.6.7 + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + # A list of urls that point to additional manifests. + extraManifests: [] + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # A list of inline Kubernetes manifests. + inlineManifests: [] + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-cp2 +# hostname: controlplane1.example.org +--- +apiVersion: v1alpha1 +kind: ExtensionServiceConfig +name: tailscale # Name of the extension service. +# The environment for the extension service. +environment: + - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-cp3.yaml b/talos/configs/talos-cp3.yaml new file mode 100644 index 0000000..2d83faf --- /dev/null +++ b/talos/configs/talos-cp3.yaml @@ -0,0 +1,407 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: controlplane # Defines the role of the machine within the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + # Used to provide instructions for installations. + install: + disk: /dev/sda # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation. + extensions: + - image: ghcr.io/siderolabs/tailscale:1.82.1 + wipe: false # Indicates if the installation disk should be wiped at installation time. + grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. + extraKernelArgs: + - console=tty0 + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + # Features describe individual Talos features that can be switched on or off. + features: + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + # Configures the node labels for the machine. + nodeLabels: + node.kubernetes.io/exclude-from-external-load-balancers: "" + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: btrfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home-cluster # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + aggregatorCA: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + # The base64 encoded private key for service account token generation. + serviceAccount: + key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K + # API server specific configuration options. + apiServer: + image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. + # Configure the API server admission plugins. + admissionControl: + - name: PodSecurity # Name is the name of the admission controller. + # Configuration is an embedded configuration object to be used as the plugin's + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + defaults: + audit: restricted + audit-version: latest + enforce: baseline + enforce-version: latest + warn: restricted + warn-version: latest + exemptions: + namespaces: + - kube-system + runtimeClasses: [] + usernames: [] + kind: PodSecurityConfiguration + # Configure the API server audit policy. + auditPolicy: + apiVersion: audit.k8s.io/v1 + kind: Policy + rules: + - level: Metadata + + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + # Controller manager server specific configuration options. + controllerManager: + image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. + # Kube-proxy server-specific configuration options + proxy: + image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. + + # # Disable kube-proxy deployment on cluster bootstrap. + # disabled: false + # Scheduler server specific configuration options. + scheduler: + image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + # Etcd specific configuration options. + etcd: + # The `ca` is the root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + + # # The container image used to create the etcd service. + # image: registry.k8s.io/etcd:v3.6.7 + + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + # A list of urls that point to additional manifests. + extraManifests: [] + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # A list of inline Kubernetes manifests. + inlineManifests: [] + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-cp3 +# hostname: controlplane1.example.org +--- +apiVersion: v1alpha1 +kind: ExtensionServiceConfig +name: tailscale # Name of the extension service. +# The environment for the extension service. +environment: + - TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF diff --git a/talos/configs/talos-worker1.yaml b/talos/configs/talos-worker1.yaml new file mode 100644 index 0000000..2776d89 --- /dev/null +++ b/talos/configs/talos-worker1.yaml @@ -0,0 +1,432 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: worker # Defines the role of the machine within the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + # Used to provide instructions for installations. + install: + disk: /dev/sda # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. + extraKernelArgs: + - console=tty0 + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + registries: {} + # Features describe individual Talos features that can be switched on or off. + features: + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: btrfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node labels for the machine. + + # # node labels example. + # nodeLabels: + # exampleLabel: exampleLabelValue + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home-cluster # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + + # # AggregatorCA example. + # aggregatorCA: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The base64 encoded private key for service account token generation. + + # # AggregatorCA example. + # serviceAccount: + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # API server specific configuration options. + # apiServer: + # image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. + # # Extra arguments to supply to the API server. + # extraArgs: + # feature-gates: ServerSideApply=true + # http2-max-streams-per-connection: "32" + # # Extra certificate subject alternative names for the API server's certificate. + # certSANs: + # - 1.2.3.4 + # - 4.5.6.7 + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + + # # Controller manager server specific configuration options. + # controllerManager: + # image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. + # # Extra arguments to supply to the controller manager. + # extraArgs: + # feature-gates: ServerSideApply=true + + # # Kube-proxy server-specific configuration options + # proxy: + # disabled: false # Disable kube-proxy deployment on cluster bootstrap. + # image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. + # mode: ipvs # proxy mode of kube-proxy. + # # Extra arguments to supply to kube-proxy. + # extraArgs: + # proxy-mode: iptables + + # # Scheduler server specific configuration options. + # scheduler: + # image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. + # # Extra arguments to supply to the scheduler. + # extraArgs: + # feature-gates: AllBeta=true + + # # Etcd specific configuration options. + # etcd: + # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. + # # The `ca` is the root certificate authority of the PKI. + # ca: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # # Extra arguments to supply to etcd. + # extraArgs: + # election-timeout: "5000" + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A list of urls that point to additional manifests. + # extraManifests: + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # A list of inline Kubernetes manifests. + # inlineManifests: + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-worker1 +# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker2.yaml b/talos/configs/talos-worker2.yaml new file mode 100644 index 0000000..3a08b0d --- /dev/null +++ b/talos/configs/talos-worker2.yaml @@ -0,0 +1,432 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: worker # Defines the role of the machine within the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + # Used to provide instructions for installations. + install: + disk: /dev/sda # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. + extraKernelArgs: + - console=tty0 + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + registries: {} + # Features describe individual Talos features that can be switched on or off. + features: + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: btrfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node labels for the machine. + + # # node labels example. + # nodeLabels: + # exampleLabel: exampleLabelValue + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home-cluster # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + + # # AggregatorCA example. + # aggregatorCA: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The base64 encoded private key for service account token generation. + + # # AggregatorCA example. + # serviceAccount: + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # API server specific configuration options. + # apiServer: + # image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. + # # Extra arguments to supply to the API server. + # extraArgs: + # feature-gates: ServerSideApply=true + # http2-max-streams-per-connection: "32" + # # Extra certificate subject alternative names for the API server's certificate. + # certSANs: + # - 1.2.3.4 + # - 4.5.6.7 + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + + # # Controller manager server specific configuration options. + # controllerManager: + # image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. + # # Extra arguments to supply to the controller manager. + # extraArgs: + # feature-gates: ServerSideApply=true + + # # Kube-proxy server-specific configuration options + # proxy: + # disabled: false # Disable kube-proxy deployment on cluster bootstrap. + # image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. + # mode: ipvs # proxy mode of kube-proxy. + # # Extra arguments to supply to kube-proxy. + # extraArgs: + # proxy-mode: iptables + + # # Scheduler server specific configuration options. + # scheduler: + # image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. + # # Extra arguments to supply to the scheduler. + # extraArgs: + # feature-gates: AllBeta=true + + # # Etcd specific configuration options. + # etcd: + # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. + # # The `ca` is the root certificate authority of the PKI. + # ca: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # # Extra arguments to supply to etcd. + # extraArgs: + # election-timeout: "5000" + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A list of urls that point to additional manifests. + # extraManifests: + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # A list of inline Kubernetes manifests. + # inlineManifests: + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-worker2 +# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker3.yaml b/talos/configs/talos-worker3.yaml new file mode 100644 index 0000000..9d7f6c2 --- /dev/null +++ b/talos/configs/talos-worker3.yaml @@ -0,0 +1,432 @@ +version: v1alpha1 # Indicates the schema used to decode the contents. +debug: false # Enable verbose logging to the console. +persist: true +# Provides machine specific configuration options. +machine: + type: worker # Defines the role of the machine within the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. + # The root certificate authority of the PKI. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Extra certificate subject alternative names for the machine's certificate. + certSANs: [] + # # Uncomment this to enable SANs. + # - 10.0.0.10 + # - 172.16.0.10 + # - 192.168.0.10 + + # Used to provide additional options to the kubelet. + kubelet: + image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image. + defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. + disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory. + + # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. + # clusterDNS: + # - 10.96.0.10 + # - 169.254.2.53 + + # # The `extraArgs` field is used to provide additional flags to the kubelet. + # extraArgs: + # key: value + + # # The `extraMounts` field is used to add additional mounts to the kubelet container. + # extraMounts: + # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. + # type: bind # Type specifies the mount kind. + # source: /var/lib/example # Source specifies the source path of the mount. + # # Options are fstab style mount options. + # options: + # - bind + # - rshared + # - rw + + # # The `extraConfig` field is used to provide kubelet configuration overrides. + # extraConfig: + # serverTLSBootstrap: true + + # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. + # credentialProviderConfig: + # apiVersion: kubelet.config.k8s.io/v1 + # kind: CredentialProviderConfig + # providers: + # - apiVersion: credentialprovider.kubelet.k8s.io/v1 + # defaultCacheDuration: 12h + # matchImages: + # - '*.dkr.ecr.*.amazonaws.com' + # - '*.dkr.ecr.*.amazonaws.com.cn' + # - '*.dkr.ecr-fips.*.amazonaws.com' + # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' + # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' + # name: ecr-credential-provider + + # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. + # nodeIP: + # # The `validSubnets` field configures the networks to pick kubelet node IP from. + # validSubnets: + # - 10.0.0.0/8 + # - '!10.0.0.3/32' + # - fdc7::/16 + # Provides machine specific network configuration options. + network: + + # # Configures KubeSpan feature. + # kubespan: + # enabled: true # Enable the KubeSpan feature. + # Used to provide instructions for installations. + install: + disk: /dev/sda # The disk used for installations. + image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation. + wipe: false # Indicates if the installation disk should be wiped at installation time. + grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. + extraKernelArgs: + - console=tty0 + + # # Look up disk using disk attributes like model, size, serial and others. + # diskSelector: + # size: 4GB # Disk size. + # model: WDC* # Disk model `/sys/block//device/model`. + # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. + registries: {} + # Features describe individual Talos features that can be switched on or off. + features: + diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. + # KubePrism - local proxy/load balancer on defined port that will distribute + kubePrism: + enabled: true # Enable KubePrism support - will start local load balancing proxy. + port: 7445 # KubePrism port. + # Configures host DNS caching resolver. + hostDNS: + enabled: true # Enable host DNS caching resolver. + forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. + + # # Configure Talos API access from Kubernetes pods. + # kubernetesTalosAPIAccess: + # enabled: true # Enable Talos API access from Kubernetes pods. + # # The list of Talos API roles which can be granted for access from Kubernetes pods. + # allowedRoles: + # - os:reader + # # The list of Kubernetes namespaces Talos API access is available from. + # allowedKubernetesNamespaces: + # - kube-system + + # # Provides machine specific control plane configuration options. + + # # ControlPlane definition example. + # controlPlane: + # # Controller manager machine specific configuration options. + # controllerManager: + # disabled: false # Disable kube-controller-manager on the node. + # # Scheduler machine specific configuration options. + # scheduler: + # disabled: true # Disable kube-scheduler on the node. + + # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. + + # # nginx static pod. + # pods: + # - apiVersion: v1 + # kind: pod + # metadata: + # name: nginx + # spec: + # containers: + # - image: nginx + # name: nginx + + # # Allows the addition of user specified files. + + # # MachineFiles usage example. + # files: + # - content: '...' # The contents of the file. + # permissions: 0o666 # The file's permissions in octal. + # path: /tmp/file.txt # The path of the file. + # op: append # The operation to use + + # # The `env` field allows for the addition of environment variables. + + # # Environment variables definition examples. + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: info + # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" + # https_proxy: http://SERVER:PORT/ + # env: + # GRPC_GO_LOG_SEVERITY_LEVEL: error + # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ + # env: + # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ + + # # Used to configure the machine's sysctls. + + # # MachineSysctls usage example. + # sysctls: + # kernel.domainname: talos.dev + # net.ipv4.ip_forward: "0" + # net/ipv6/conf/eth0.100/disable_ipv6: "1" + + # # Used to configure the machine's sysfs. + + # # MachineSysfs usage example. + # sysfs: + # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance + + # # Configures the udev system. + # udev: + # # List of udev rules to apply to the udev system + # rules: + # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" + + # # Configures the logging system. + # logging: + # # Logging destination. + # destinations: + # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". + # format: json_lines # Logs format. + + # # Configures the kernel. + # kernel: + # # Kernel modules to load. + # modules: + # - name: btrfs # Module name. + + # # Configures the seccomp profiles for the machine. + # seccompProfiles: + # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. + # # The `value` field is used to provide the seccomp profile. + # value: + # defaultAction: SCMP_ACT_LOG + + # # Override (patch) settings in the default OCI runtime spec for CRI containers. + + # # override default open file limit + # baseRuntimeSpecOverrides: + # process: + # rlimits: + # - hard: 1024 + # soft: 1024 + # type: RLIMIT_NOFILE + + # # Configures the node labels for the machine. + + # # node labels example. + # nodeLabels: + # exampleLabel: exampleLabelValue + + # # Configures the node annotations for the machine. + + # # node annotations example. + # nodeAnnotations: + # customer.io/rack: r13a25 + + # # Configures the node taints for the machine. Effect is optional. + + # # node taints example. + # nodeTaints: + # exampleTaint: exampleTaintValue:NoSchedule +# Provides cluster specific configuration options. +cluster: + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). + # Provides control plane specific configuration options. + controlPlane: + endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. + clusterName: home-cluster # Configures the cluster's name. + # Provides cluster specific network configuration options. + network: + dnsDomain: cluster.local # The domain used by Kubernetes DNS. + # The pod subnet CIDR. + podSubnets: + - 10.244.0.0/16 + # The service subnet CIDR. + serviceSubnets: + - 10.96.0.0/12 + + # # The CNI used. + # cni: + # name: custom # Name of CNI to use. + # # URLs containing manifests to apply for the CNI. + # urls: + # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + # The base64 encoded root certificate authority used by Kubernetes. + ca: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: "" + # Configures cluster member discovery. + discovery: + enabled: true # Enable the cluster membership discovery feature. + # Configure registries used for cluster member discovery. + registries: + # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information + kubernetes: + disabled: true # Disable Kubernetes discovery registry. + # Service registry is using an external service to push and pull information about cluster members. + service: {} + # # External service endpoint. + # endpoint: https://discovery.talos.dev/ + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + + # # Decryption secret example (do not use in production!). + # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= + + # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. + + # # AggregatorCA example. + # aggregatorCA: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # The base64 encoded private key for service account token generation. + + # # AggregatorCA example. + # serviceAccount: + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + + # # API server specific configuration options. + # apiServer: + # image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. + # # Extra arguments to supply to the API server. + # extraArgs: + # feature-gates: ServerSideApply=true + # http2-max-streams-per-connection: "32" + # # Extra certificate subject alternative names for the API server's certificate. + # certSANs: + # - 1.2.3.4 + # - 4.5.6.7 + # # Configure the API server admission plugins. + # admissionControl: + # - name: PodSecurity # Name is the name of the admission controller. + # # Configuration is an embedded configuration object to be used as the plugin's + # configuration: + # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 + # defaults: + # audit: restricted + # audit-version: latest + # enforce: baseline + # enforce-version: latest + # warn: restricted + # warn-version: latest + # exemptions: + # namespaces: + # - kube-system + # runtimeClasses: [] + # usernames: [] + # kind: PodSecurityConfiguration + # # Configure the API server audit policy. + # auditPolicy: + # apiVersion: audit.k8s.io/v1 + # kind: Policy + # rules: + # - level: Metadata + # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. + # authorizationConfig: + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: webhook # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: Deny + # matchConditionSubjectAccessReviewVersion: v1 + # matchConditions: + # - expression: has(request.resourceAttributes) + # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' + # subjectAccessReviewVersion: v1 + # timeout: 3s + # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. + # name: in-cluster-authorizer # Name is used to describe the authorizer. + # # webhook is the configuration for the webhook authorizer. + # webhook: + # connectionInfo: + # type: InClusterConfig + # failurePolicy: NoOpinion + # matchConditionSubjectAccessReviewVersion: v1 + # subjectAccessReviewVersion: v1 + # timeout: 3s + + # # Controller manager server specific configuration options. + # controllerManager: + # image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest. + # # Extra arguments to supply to the controller manager. + # extraArgs: + # feature-gates: ServerSideApply=true + + # # Kube-proxy server-specific configuration options + # proxy: + # disabled: false # Disable kube-proxy deployment on cluster bootstrap. + # image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest. + # mode: ipvs # proxy mode of kube-proxy. + # # Extra arguments to supply to kube-proxy. + # extraArgs: + # proxy-mode: iptables + + # # Scheduler server specific configuration options. + # scheduler: + # image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest. + # # Extra arguments to supply to the scheduler. + # extraArgs: + # feature-gates: AllBeta=true + + # # Etcd specific configuration options. + # etcd: + # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. + # # The `ca` is the root certificate authority of the PKI. + # ca: + # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t + # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== + # # Extra arguments to supply to etcd. + # extraArgs: + # election-timeout: "5000" + # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. + # advertisedSubnets: + # - 10.0.0.0/8 + + # # Core DNS specific configuration options. + # coreDNS: + # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. + + # # External cloud provider configuration. + # externalCloudProvider: + # enabled: true # Enable external cloud provider. + # # A list of urls that point to additional manifests for an external cloud provider. + # manifests: + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml + # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml + + # # A list of urls that point to additional manifests. + # extraManifests: + # - https://www.example.com/manifest1.yaml + # - https://www.example.com/manifest2.yaml + + # # A map of key value pairs that will be added while fetching the extraManifests. + # extraManifestHeaders: + # Token: "1234567" + # X-ExtraInfo: info + + # # A list of inline Kubernetes manifests. + # inlineManifests: + # - name: namespace-ci # Name of the manifest. + # contents: |- # Manifest contents as a string. + # apiVersion: v1 + # kind: Namespace + # metadata: + # name: ci + + # # Settings for admin kubeconfig generation. + # adminKubeconfig: + # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). + + # # Allows running workload on control-plane nodes. + # allowSchedulingOnControlPlanes: true +--- +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-worker3 +# hostname: controlplane1.example.org diff --git a/talos/controlplane.yaml b/talos/controlplane.yaml index d5c0a16..09ec3f4 100644 --- a/talos/controlplane.yaml +++ b/talos/controlplane.yaml @@ -4,11 +4,11 @@ persist: true # Provides machine specific configuration options. machine: type: controlplane # Defines the role of the machine within the cluster. - token: 6mvqo9.nn5sbv4fhyifbqjk # The `token` is used by a machine to join the PKI of the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. # The root certificate authority of the PKI. ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRFl1WkVJcC9ONEhLNG9RcndlcnlvZUVYNkt4WFFzWUcyeDRXV3ZxTVM4eAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K # Extra certificate subject alternative names for the machine's certificate. certSANs: [] # # Uncomment this to enable SANs. @@ -220,8 +220,8 @@ machine: # exampleTaint: exampleTaintValue:NoSchedule # Provides cluster specific configuration options. cluster: - id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM= # Shared secret of cluster (base64 encoded random 32 bytes). + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). # Provides control plane specific configuration options. controlPlane: endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. @@ -242,19 +242,19 @@ cluster: # # URLs containing manifests to apply for the CNI. # urls: # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: fkth11.nmhzlprifn9pe6jl # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - secretboxEncryptionSecret: 83iFqNeoP3fTSwstgBRWidjicy//f71Ui83VVcqI6So= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). # The base64 encoded root certificate authority used by Kubernetes. ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlQYklVSWtZWnRVaDI4Z2dqZERsbmp3bUVUWDJ0eEtpV2I2ek1xMTA2aDRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaVViOG1MMkFQM3k5Y0VsL2xVSTFTY2VjdUlmdERKQ0F1VzIwdGY0OGhQSnBPSzZ3aWRBTgp6OUxyR1Q0dFIwbnlUc3JEQUpjOFcwZnBJeHpoTXkvWHFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRREFKZDVPVGdJbnFnZ0NnMUUrNmFaVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhNVEUzTWpBeU9Wb1hEVE0yTURFd09URTNNakF5T1Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTi9oNms5MEMzT0VLOWlLY3daZEFvWFVXNDBXY0JFWnNEYnRxamMwWkI5cUxseHpLMkdYCnZZZHVsODJ4c1JiTjlXVjFoS085NjZCc2w5TXF2ZDAvOXJHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVpTGtETGhmcVQ5OUJ4VVBUVFBOa2tyUG1xRkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFQOXJxVHhXeEFWRXA2MElnNkgxSDJNaVpxc20waXlTSWFGNktHSDhGRDB5QWlCWkhWRml1SzFvKzZUWEt6QzkKSnNjait3emhuSTZWYUNQU2pEUUt3NGFrYkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTYXNCall3ZDAzcjZxRUFJaXNCTU9lWm5Dd3BRcm54cnE5T1JNZnFkT01vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMytIcVQzUUxjNFFyMklwekJsMENoZFJialJad0VSbXdOdTJxTnpSa0gyb3VYSE1yWVplOQpoMjZYemJHeEZzMzFaWFdFbzczcm9HeVgweXE5M1QvMnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # The base64 encoded private key for service account token generation. serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBOXRQbWRWMDFYTWNXenAzc3RXS3p3NHFDcW9kZDVjaXVQanF2MXQ5VkcxbHRQNEJTCmlVS3U3VERTS3R4Zm1qQ3pMLzVvVHVwMUVPbDRHckVOK0RZNDhvZjN1MU1VdDdjWE9lelF5SXBLaitDMUJyRTEKQ29pNTFOUHdXNGpUaHRPTExXUmRrU2doUCtPaDM0alpzelBvczVvS1E4aFJtK1hZNzRjbytPZ3lOL2NORXQzNQowa3h1aVEyUzZPam51Z0tIZk9zOFhRL2d0cDloSitUYW0zdkpTSHdOUFpOVkFHb3dYSmQrRU5PeEhMWjlLSDIrCmNOcmpNZGUvbmZza3lvV2h1NXZFZnQxTmV0ZkEwWXZSb1hzZERqdS82YXJ5NW92MWNoMDJYVENhc0tLN05RajAKT1Y2REVqZm5PTlNRRndXRUpTVzY4RVlWY1AxSCtoY3E4VkozODM3b0JyWVpUWUNFZllMaC8rNnpZY3RjSGdLTAo5VFhvdkxkTlZLaDlpZ0Q5NVlsT3lsTmpCVlVDNm45Q0RPQ3BZWDUzaXdiTGl1VFVsRUNwK3g0eCtrcVlPUFNDCmFrWVhwZXZ2R1F0STFUTDFLK2lDamNXUm9EaVZoblFWREhsV243R3pqeFNKMEJWd25ydFk3aWlXR1JmemxMTVUKQzUrVVY3TGxSaytwMFlDMG85dmczbXZQNkJRTm5NQUtETGc5MG5PSjVzZWFkR21DQVdyVnI2TjhhaDR2ZmpGdQprUkVVa29vcjZmYXlERmxpN1pQWGYzaXVLY0FiNXhXb3JoTXVvR0tzMUFRZHdLZFdUZi9janVKOVJYR2lLSXJ2ClJWQWQ4TW82MGhKd25SRElCK1M0cUNOWXlvYXQxd2x4NldCcjQyRUZ2ekFxdk41Z0thOVBQR09KOEJjQ0F3RUEKQVFLQ0FnQml4dXc4WFovRVVEdzFWWWZzRXVManh5T0JnUWkzczNiZm1uYlNJN0FZY05KQ2ptVDVYMEZIMUxqVwp4RGhTS1ZrY1JOQ1RmRXA3Q1NPeWN0YW5WWE8ydzJrRmd6c1FSbW82R1NaNGlyZEtHdC8zSEtXZ1lKVVZzZmRICmVsdEVZcFlaQlVoWWxkbXdpclUyRXJza2R3cVNEWHc4SWdkZXZ6M3dwWU5sRU84LzdGTkVFS2N3WEx3RGh2WWEKMVZJZTQzSTdNSnlJbFprVkhIVXlGT2pUUGxlUDlXMExEbEgvQjMveEhnTXFVcjFYUTBTVkZyVkd6cUlMU1U3Ngp0dzNES25WTjhnbFJ4OWlBNTZUWGR2L2VncmxlLzlST2U4WVhNejEzZkc5TUhlNVo3OVhCWktMdjduMi9wYldYCnphRVlSWEhidDl5MjJTVXRnWDd6ZTZBSTBUc0U0clIrY0RCZndwcm9ZSHpSRUdlb2t4a0JucHRSNG1YNkNyYm8KYUxZdTJiTWpzd0dCclE5VEJiTk9vNjVkOExRV3JlaGNFY0ZSbWxXN2JCT2M5N3FVbUIvakZGSXhQMUk5NjY5WgpveXpuZ2tzcHZISHZXR2NVTTRsMVkxYkhXNCtOUFpaUk9uOFc4dGJKT2hTNjZ2YTdFQ3pnb2QzRC9aSmFmdlViCkRjTlNCdVltZTZsUisvU1Z6SEcvOTROQVZJdmdPdVVxVWxqbmlpNnRtUFBqUEduNXlNTmZ4QUN4aEJlQmZJNCsKbitqc2V4UGtHamhrSjdPVDVKQjYxQWFId28wdjJ3Y212a0I1YkE3cEo3K0k4OUp1bE9VM3V2eXQ2OUQ2b1k0agpEQk00ZVVVd3ArZ3c1ZHVMYWpES2w0cno5SHNQQllPSUpDNE9uUE5wdXRlb2tzWWEyUUtDQVFFQS82YlpGYkI3CkZ2dGdxYkozV0ZEL1BjcjFwbnljakI4ZFZObVNBN0FhVHZaZll5THovbHlJM0VUQkJUbkhWUk9YVy9qa2VYcGcKa1FpRGRLbzlZS2g3Y1EwdTBwVnVDeGNOdXRkRmIwRkROMERvWjNuRlJlSkpEcmh2c2gyRDkvMGdaTmw2Tkg0dApPMUxWUDBGUStpeTZ5TGlUci9XelVZYVc1OHVNcmw2cFUxRStQTjJPQ1l4bnBmVk0vbFJQbHdJUFF5ZUYrc3krCkZibjBnVTArOEJHY0R6aDJZZldBZ1J4OUt5RStNcWtROVdIQzY2MXZkUGFPdm5ROTY3Y2xTRE5kU3FiRFRuU3EKSlExbVdLT0c3RzJXRGtDcmw0RElZU0tQQUZCeWowbGcxeCtjQ1JoN1hZOUtDVnZxMmFkcXJOZ1A4UHZmblFpdwpGcThuSWE1UnNhM3Y5UUtDQVFFQTl5bjVuNW5rQUd4Z2JlSEF4MnFMbWFBNHRvUGVHUkxHeUdCWU9Wa3RtSFN5Ck4rS2tvamw4ZmEyN0ppTVVNWHRONzhsSzdNM3lGQldSWENocUgvaURZYmtVZFNLUk4yTFJBRWtudTkxTWVVTWkKV1pmMVo5QzNpL2JlUmV4aEl0aGFNQkk2YldQeTMzTExYREdsZXlmTnp6N21nNFVOQm5relp6aUMwRjN0NUlMcgp5WG1VdDZxUjNPQlBIcUhDZXhTeERqQVk4ZDBXTjhQejk0YUJkNW1pelBEQ1FwYkFuTmZ4NFVGU0Z5N2hRRGVrCkFQUm5MY0tacXZibGJzT3JlUUo3TUJXV1h6U3VwYnUxL2krYTNwZWNwMTRmek9HMC9GaDh0c1JQTUtHNFNDcDYKQ2lOVm55T210MGRHaWxaOXV4emRVZVF6RXBSZk93YkF6UlNqYW95VVd3S0NBUUVBMDBLQWovRFh0dVVpT3ZsVQpzREcyeXN5R2RQN3lxc1FuaSsrRFB2THV1cVBUcld1NzcwMXVkMytGZGhrS0JONzhyQzhnTnRhUEtDcTkzdEd6CmlNV1J4SmxkUVAzbEF0c1pLSFl1VmNLN2xkUlllUEhpdUY1SGV4ZWtqYTdnV0RUZjZSYmlhckIrRmxEY0VicWEKL1RHclpLVkt2aFN2QzBiS08yQTByLzlmczQ4bWZFdWx6WFF1VHJGSDM3K3lTWnFWSEN4MEJnM2RZcnpaTldTdApCdHUyZDhsejRuMXFwTWJ6RklvVENQQTNLRitTSVFtZ1dpcEpTVTlydi9jSG93TjNLM0psWU5iOXAwTE1lYUVnCnBRM2wrMzhyalRZSjRHTWJndW4zMFRxVkFSQ0k4K2M4UXROZkhoN01FdkxMTDJ3WXVFNmJ1ZnZzNzhIcjkyUkMKOUM1RlpRS0NBUUVBb2pxaTVlY1VpRkthV0lVOUM2Y2JTaEtvSnVRVyswNGZ1NVhCVXFMK0VudEdIdmhjSno2awpQN213aFMreEtXbE5sbjRBOTcyVmp5azQ1OHgvRzh6NkwwSlQ4eTVsTW4xaHdWWkRCa1FTMWVVQ3Z0dkc4QVZHCjlFOXRSV2dKdWQxWUZRVmg1RHNlUnh3Sjd0R0hWSGFqMTh2cGNabjdHcXlpMkxWMjUxMC9zQ1ZlcmpkbkxjWi8KUndMVDY3OHc3Nmg5TGxyVGhLMGcwQ21HRUlud29KZnZDNlZiWEdtbXMwdnFMM2U0Y2c4TE9pTkxPblV3NUJBKwozTUNCaDFwWFNtNGVmVWt1RWY5NlFyNGFqbVNndWttNVFRRyt6Yk80SDRuVkVnRjRHT3VORVpFUDJXZW40M1I3CkVRRnZnNDJScVNjZy9ZZFRIbmJVcXVHYjJ3QVk0dTZ5MFFLQ0FRRUFpQm0zbkUxTGg2VFFtZjlZQVVnV1pNeVkKQWlVSHNFUnRTUGdCdWgrZzUxY1krMmp2ckEvbVZ3bG5PQlphWmoreU52Tk5ESktoWUk3TDlFb2krbTlZM1duUAp4OGFlRndhNFBRMzhUU09wM0hSYXhtcUd2Ylo0aktqcVVSc3R3b1B2UzkyK2JGZUxyaFArREh2dmhOMW41TDNkCjZtdFQycjVpSkZWWEc1RVZWMGpUdkVMUVBDT013c0NVL2hyOVdCY0hpeFdIdzBGOGdZaEo2VjJ6WjB2ZEhTUHYKMTNhUWFHZlh4M0o2NEN4dy9CWmJPaUdnYUNOOEtBKzJhYmhLY2M1UTR5L21QRUN1WXRlVHJPMFZURU9GOHczMgpta29SOUUxWHI2RnowK1Z1b0puKzBXSWNkN0l5dS8ybHZzWjVPc2ltMVRkUS9VaFAvVjlsMHpweGhOYlJUQT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K # API server specific configuration options. apiServer: image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest. @@ -337,8 +337,8 @@ cluster: etcd: # The `ca` is the root certificate authority of the PKI. ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNPZ0F3SUJBZ0lRRFV2eGpQbDViSFRSR05KN1VSQ0JzVEFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE1URTNNakF5T1ZvWERUTTJNREV3T1RFM01qQXlPVm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpWSlhnSGRMbTJFCjFSNmJyZjJ2aG91blBndlpzeVlsZFA5TlMzT0FXaGk1dUczc2JBTi96ZnF1VEtpOUFjQXpuOWNnbHY5MkI3MXkKQXNtMktPcUJXYTJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVOGpCellJc3RITjA2CjFNSDBsNjFRaXlibnFIa3dDZ1lJS29aSXpqMEVBd0lEUndBd1JBSWdWbDZ0SWw5MlN0YUtKWDhkVnpzKzJiWUgKQi9sTnlPbkx1eGNZTWsvL1lGTUNJQXZWT1ZMckQ4Q3hCMlgyMDREVVpOL0t6KzVZcHFtRy9yUTFiRnBDSkF1NwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVKaktuempHY1ViakNRekpkamF0cFNXUVlacnI2MHg4b1NNeEV3eUhkNUFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbFVsZUFkMHViWVRWSHB1dC9hK0dpNmMrQzltekppVjAvMDFMYzRCYUdMbTRiZXhzQTMvTgorcTVNcUwwQndET2YxeUNXLzNZSHZYSUN5YllvNm9GWnJRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= # # The container image used to create the etcd service. # image: registry.k8s.io/etcd:v3.6.7 diff --git a/talos/secrets.yaml.backup b/talos/secrets.yaml.backup new file mode 100644 index 0000000..d42ab85 --- /dev/null +++ b/talos/secrets.yaml.backup @@ -0,0 +1,23 @@ +cluster: + id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c= + secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM= +secrets: + bootstraptoken: fkth11.nmhzlprifn9pe6jl + secretboxencryptionsecret: 83iFqNeoP3fTSwstgBRWidjicy//f71Ui83VVcqI6So= +trustdinfo: + token: 6mvqo9.nn5sbv4fhyifbqjk +certs: + etcd: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNPZ0F3SUJBZ0lRRFV2eGpQbDViSFRSR05KN1VSQ0JzVEFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE1URTNNakF5T1ZvWERUTTJNREV3T1RFM01qQXlPVm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpWSlhnSGRMbTJFCjFSNmJyZjJ2aG91blBndlpzeVlsZFA5TlMzT0FXaGk1dUczc2JBTi96ZnF1VEtpOUFjQXpuOWNnbHY5MkI3MXkKQXNtMktPcUJXYTJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVOGpCellJc3RITjA2CjFNSDBsNjFRaXlibnFIa3dDZ1lJS29aSXpqMEVBd0lEUndBd1JBSWdWbDZ0SWw5MlN0YUtKWDhkVnpzKzJiWUgKQi9sTnlPbkx1eGNZTWsvL1lGTUNJQXZWT1ZMckQ4Q3hCMlgyMDREVVpOL0t6KzVZcHFtRy9yUTFiRnBDSkF1NwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVKaktuempHY1ViakNRekpkamF0cFNXUVlacnI2MHg4b1NNeEV3eUhkNUFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbFVsZUFkMHViWVRWSHB1dC9hK0dpNmMrQzltekppVjAvMDFMYzRCYUdMbTRiZXhzQTMvTgorcTVNcUwwQndET2YxeUNXLzNZSHZYSUN5YllvNm9GWnJRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + k8s: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlQYklVSWtZWnRVaDI4Z2dqZERsbmp3bUVUWDJ0eEtpV2I2ek1xMTA2aDRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaVViOG1MMkFQM3k5Y0VsL2xVSTFTY2VjdUlmdERKQ0F1VzIwdGY0OGhQSnBPSzZ3aWRBTgp6OUxyR1Q0dFIwbnlUc3JEQUpjOFcwZnBJeHpoTXkvWHFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + k8saggregator: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRREFKZDVPVGdJbnFnZ0NnMUUrNmFaVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhNVEUzTWpBeU9Wb1hEVE0yTURFd09URTNNakF5T1Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTi9oNms5MEMzT0VLOWlLY3daZEFvWFVXNDBXY0JFWnNEYnRxamMwWkI5cUxseHpLMkdYCnZZZHVsODJ4c1JiTjlXVjFoS085NjZCc2w5TXF2ZDAvOXJHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVpTGtETGhmcVQ5OUJ4VVBUVFBOa2tyUG1xRkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFQOXJxVHhXeEFWRXA2MElnNkgxSDJNaVpxc20waXlTSWFGNktHSDhGRDB5QWlCWkhWRml1SzFvKzZUWEt6QzkKSnNjait3emhuSTZWYUNQU2pEUUt3NGFrYkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTYXNCall3ZDAzcjZxRUFJaXNCTU9lWm5Dd3BRcm54cnE5T1JNZnFkT01vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMytIcVQzUUxjNFFyMklwekJsMENoZFJialJad0VSbXdOdTJxTnpSa0gyb3VYSE1yWVplOQpoMjZYemJHeEZzMzFaWFdFbzczcm9HeVgweXE5M1QvMnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + k8sserviceaccount: + key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBOXRQbWRWMDFYTWNXenAzc3RXS3p3NHFDcW9kZDVjaXVQanF2MXQ5VkcxbHRQNEJTCmlVS3U3VERTS3R4Zm1qQ3pMLzVvVHVwMUVPbDRHckVOK0RZNDhvZjN1MU1VdDdjWE9lelF5SXBLaitDMUJyRTEKQ29pNTFOUHdXNGpUaHRPTExXUmRrU2doUCtPaDM0alpzelBvczVvS1E4aFJtK1hZNzRjbytPZ3lOL2NORXQzNQowa3h1aVEyUzZPam51Z0tIZk9zOFhRL2d0cDloSitUYW0zdkpTSHdOUFpOVkFHb3dYSmQrRU5PeEhMWjlLSDIrCmNOcmpNZGUvbmZza3lvV2h1NXZFZnQxTmV0ZkEwWXZSb1hzZERqdS82YXJ5NW92MWNoMDJYVENhc0tLN05RajAKT1Y2REVqZm5PTlNRRndXRUpTVzY4RVlWY1AxSCtoY3E4VkozODM3b0JyWVpUWUNFZllMaC8rNnpZY3RjSGdLTAo5VFhvdkxkTlZLaDlpZ0Q5NVlsT3lsTmpCVlVDNm45Q0RPQ3BZWDUzaXdiTGl1VFVsRUNwK3g0eCtrcVlPUFNDCmFrWVhwZXZ2R1F0STFUTDFLK2lDamNXUm9EaVZoblFWREhsV243R3pqeFNKMEJWd25ydFk3aWlXR1JmemxMTVUKQzUrVVY3TGxSaytwMFlDMG85dmczbXZQNkJRTm5NQUtETGc5MG5PSjVzZWFkR21DQVdyVnI2TjhhaDR2ZmpGdQprUkVVa29vcjZmYXlERmxpN1pQWGYzaXVLY0FiNXhXb3JoTXVvR0tzMUFRZHdLZFdUZi9janVKOVJYR2lLSXJ2ClJWQWQ4TW82MGhKd25SRElCK1M0cUNOWXlvYXQxd2x4NldCcjQyRUZ2ekFxdk41Z0thOVBQR09KOEJjQ0F3RUEKQVFLQ0FnQml4dXc4WFovRVVEdzFWWWZzRXVManh5T0JnUWkzczNiZm1uYlNJN0FZY05KQ2ptVDVYMEZIMUxqVwp4RGhTS1ZrY1JOQ1RmRXA3Q1NPeWN0YW5WWE8ydzJrRmd6c1FSbW82R1NaNGlyZEtHdC8zSEtXZ1lKVVZzZmRICmVsdEVZcFlaQlVoWWxkbXdpclUyRXJza2R3cVNEWHc4SWdkZXZ6M3dwWU5sRU84LzdGTkVFS2N3WEx3RGh2WWEKMVZJZTQzSTdNSnlJbFprVkhIVXlGT2pUUGxlUDlXMExEbEgvQjMveEhnTXFVcjFYUTBTVkZyVkd6cUlMU1U3Ngp0dzNES25WTjhnbFJ4OWlBNTZUWGR2L2VncmxlLzlST2U4WVhNejEzZkc5TUhlNVo3OVhCWktMdjduMi9wYldYCnphRVlSWEhidDl5MjJTVXRnWDd6ZTZBSTBUc0U0clIrY0RCZndwcm9ZSHpSRUdlb2t4a0JucHRSNG1YNkNyYm8KYUxZdTJiTWpzd0dCclE5VEJiTk9vNjVkOExRV3JlaGNFY0ZSbWxXN2JCT2M5N3FVbUIvakZGSXhQMUk5NjY5WgpveXpuZ2tzcHZISHZXR2NVTTRsMVkxYkhXNCtOUFpaUk9uOFc4dGJKT2hTNjZ2YTdFQ3pnb2QzRC9aSmFmdlViCkRjTlNCdVltZTZsUisvU1Z6SEcvOTROQVZJdmdPdVVxVWxqbmlpNnRtUFBqUEduNXlNTmZ4QUN4aEJlQmZJNCsKbitqc2V4UGtHamhrSjdPVDVKQjYxQWFId28wdjJ3Y212a0I1YkE3cEo3K0k4OUp1bE9VM3V2eXQ2OUQ2b1k0agpEQk00ZVVVd3ArZ3c1ZHVMYWpES2w0cno5SHNQQllPSUpDNE9uUE5wdXRlb2tzWWEyUUtDQVFFQS82YlpGYkI3CkZ2dGdxYkozV0ZEL1BjcjFwbnljakI4ZFZObVNBN0FhVHZaZll5THovbHlJM0VUQkJUbkhWUk9YVy9qa2VYcGcKa1FpRGRLbzlZS2g3Y1EwdTBwVnVDeGNOdXRkRmIwRkROMERvWjNuRlJlSkpEcmh2c2gyRDkvMGdaTmw2Tkg0dApPMUxWUDBGUStpeTZ5TGlUci9XelVZYVc1OHVNcmw2cFUxRStQTjJPQ1l4bnBmVk0vbFJQbHdJUFF5ZUYrc3krCkZibjBnVTArOEJHY0R6aDJZZldBZ1J4OUt5RStNcWtROVdIQzY2MXZkUGFPdm5ROTY3Y2xTRE5kU3FiRFRuU3EKSlExbVdLT0c3RzJXRGtDcmw0RElZU0tQQUZCeWowbGcxeCtjQ1JoN1hZOUtDVnZxMmFkcXJOZ1A4UHZmblFpdwpGcThuSWE1UnNhM3Y5UUtDQVFFQTl5bjVuNW5rQUd4Z2JlSEF4MnFMbWFBNHRvUGVHUkxHeUdCWU9Wa3RtSFN5Ck4rS2tvamw4ZmEyN0ppTVVNWHRONzhsSzdNM3lGQldSWENocUgvaURZYmtVZFNLUk4yTFJBRWtudTkxTWVVTWkKV1pmMVo5QzNpL2JlUmV4aEl0aGFNQkk2YldQeTMzTExYREdsZXlmTnp6N21nNFVOQm5relp6aUMwRjN0NUlMcgp5WG1VdDZxUjNPQlBIcUhDZXhTeERqQVk4ZDBXTjhQejk0YUJkNW1pelBEQ1FwYkFuTmZ4NFVGU0Z5N2hRRGVrCkFQUm5MY0tacXZibGJzT3JlUUo3TUJXV1h6U3VwYnUxL2krYTNwZWNwMTRmek9HMC9GaDh0c1JQTUtHNFNDcDYKQ2lOVm55T210MGRHaWxaOXV4emRVZVF6RXBSZk93YkF6UlNqYW95VVd3S0NBUUVBMDBLQWovRFh0dVVpT3ZsVQpzREcyeXN5R2RQN3lxc1FuaSsrRFB2THV1cVBUcld1NzcwMXVkMytGZGhrS0JONzhyQzhnTnRhUEtDcTkzdEd6CmlNV1J4SmxkUVAzbEF0c1pLSFl1VmNLN2xkUlllUEhpdUY1SGV4ZWtqYTdnV0RUZjZSYmlhckIrRmxEY0VicWEKL1RHclpLVkt2aFN2QzBiS08yQTByLzlmczQ4bWZFdWx6WFF1VHJGSDM3K3lTWnFWSEN4MEJnM2RZcnpaTldTdApCdHUyZDhsejRuMXFwTWJ6RklvVENQQTNLRitTSVFtZ1dpcEpTVTlydi9jSG93TjNLM0psWU5iOXAwTE1lYUVnCnBRM2wrMzhyalRZSjRHTWJndW4zMFRxVkFSQ0k4K2M4UXROZkhoN01FdkxMTDJ3WXVFNmJ1ZnZzNzhIcjkyUkMKOUM1RlpRS0NBUUVBb2pxaTVlY1VpRkthV0lVOUM2Y2JTaEtvSnVRVyswNGZ1NVhCVXFMK0VudEdIdmhjSno2awpQN213aFMreEtXbE5sbjRBOTcyVmp5azQ1OHgvRzh6NkwwSlQ4eTVsTW4xaHdWWkRCa1FTMWVVQ3Z0dkc4QVZHCjlFOXRSV2dKdWQxWUZRVmg1RHNlUnh3Sjd0R0hWSGFqMTh2cGNabjdHcXlpMkxWMjUxMC9zQ1ZlcmpkbkxjWi8KUndMVDY3OHc3Nmg5TGxyVGhLMGcwQ21HRUlud29KZnZDNlZiWEdtbXMwdnFMM2U0Y2c4TE9pTkxPblV3NUJBKwozTUNCaDFwWFNtNGVmVWt1RWY5NlFyNGFqbVNndWttNVFRRyt6Yk80SDRuVkVnRjRHT3VORVpFUDJXZW40M1I3CkVRRnZnNDJScVNjZy9ZZFRIbmJVcXVHYjJ3QVk0dTZ5MFFLQ0FRRUFpQm0zbkUxTGg2VFFtZjlZQVVnV1pNeVkKQWlVSHNFUnRTUGdCdWgrZzUxY1krMmp2ckEvbVZ3bG5PQlphWmoreU52Tk5ESktoWUk3TDlFb2krbTlZM1duUAp4OGFlRndhNFBRMzhUU09wM0hSYXhtcUd2Ylo0aktqcVVSc3R3b1B2UzkyK2JGZUxyaFArREh2dmhOMW41TDNkCjZtdFQycjVpSkZWWEc1RVZWMGpUdkVMUVBDT013c0NVL2hyOVdCY0hpeFdIdzBGOGdZaEo2VjJ6WjB2ZEhTUHYKMTNhUWFHZlh4M0o2NEN4dy9CWmJPaUdnYUNOOEtBKzJhYmhLY2M1UTR5L21QRUN1WXRlVHJPMFZURU9GOHczMgpta29SOUUxWHI2RnowK1Z1b0puKzBXSWNkN0l5dS8ybHZzWjVPc2ltMVRkUS9VaFAvVjlsMHpweGhOYlJUQT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + os: + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRFl1WkVJcC9ONEhLNG9RcndlcnlvZUVYNkt4WFFzWUcyeDRXV3ZxTVM4eAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K diff --git a/talos/talosconfig.backup b/talos/talosconfig.backup new file mode 100644 index 0000000..6c81913 --- /dev/null +++ b/talos/talosconfig.backup @@ -0,0 +1,12 @@ +context: home-cluster +contexts: + home-cluster: + endpoints: + - 10.0.15.1 + - 10.0.15.2 + - 10.0.15.3 + nodes: + - 10.0.15.1 + ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEJOcDFlRkxURkM3dlpLdzRxYk5hc0JNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TmpNME5UWmFGdzB5TnpBeE1UUXhOak0wTlRaYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWQ0WGFqeENScDFRZi9lZWJFRWxWa2pQS1BqZ3paZGJCCkRxUENBbGRCL1cyalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCUlV0V1RId3M3ZmRvem0wdzgyVGFBK00xb0hTREFGQmdNclpYQURRUUJ4Ni9FdgpsUHFJTFRaNHhPN0ZOM2xWNHdCdngrekpLbGE4ODdkbUtRWk50NEZUbmpadFh1eWQ5VEhaVXdsOXozN3RBUG1ZCjFxZzAzUW5ZR1lyVEt5NEQKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSXpScjY5NGp0SnRDWjZFbmp6cWhSWGREdndpa0h2eGErNzlCZzN1cDZpUAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K diff --git a/talos/worker.yaml b/talos/worker.yaml index 063a401..34855cc 100644 --- a/talos/worker.yaml +++ b/talos/worker.yaml @@ -4,10 +4,10 @@ persist: true # Provides machine specific configuration options. machine: type: worker # Defines the role of the machine within the cluster. - token: 6mvqo9.nn5sbv4fhyifbqjk # The `token` is used by a machine to join the PKI of the cluster. + token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. # The root certificate authority of the PKI. ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: "" # Extra certificate subject alternative names for the machine's certificate. certSANs: [] @@ -224,8 +224,8 @@ machine: # exampleTaint: exampleTaintValue:NoSchedule # Provides cluster specific configuration options. cluster: - id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM= # Shared secret of cluster (base64 encoded random 32 bytes). + id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). + secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). # Provides control plane specific configuration options. controlPlane: endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. @@ -246,10 +246,10 @@ cluster: # # URLs containing manifests to apply for the CNI. # urls: # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: fkth11.nmhzlprifn9pe6jl # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. + token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. # The base64 encoded root certificate authority used by Kubernetes. ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: "" # Configures cluster member discovery. discovery: diff --git a/talosconfig b/talosconfig new file mode 100644 index 0000000..e35e5db --- /dev/null +++ b/talosconfig @@ -0,0 +1,2 @@ +context: "" +contexts: {} diff --git a/terraform/talos_vms.tf b/terraform/talos_vms.tf index 6f341f7..6cdfc71 100644 --- a/terraform/talos_vms.tf +++ b/terraform/talos_vms.tf @@ -20,13 +20,16 @@ resource "proxmox_virtual_environment_vm" "talos_cp1" { } network_device { - bridge = var.network_bridge + bridge = var.network_bridge + mac_address = "BC:24:11:9B:48:92" } - lifecycle { - ignore_changes = [ - network_device, - ] + vga { + type = "std" + } + + agent { + enabled = true } } @@ -52,13 +55,16 @@ resource "proxmox_virtual_environment_vm" "talos_cp2" { } network_device { - bridge = var.network_bridge + bridge = var.network_bridge + mac_address = "BC:24:11:62:7B:3F" } - lifecycle { - ignore_changes = [ - network_device, - ] + vga { + type = "std" + } + + agent { + enabled = true } } @@ -84,13 +90,16 @@ resource "proxmox_virtual_environment_vm" "talos_cp3" { } network_device { - bridge = var.network_bridge + bridge = var.network_bridge + mac_address = "BC:24:11:D4:2F:ED" } - lifecycle { - ignore_changes = [ - network_device, - ] + vga { + type = "std" + } + + agent { + enabled = true } } @@ -116,13 +125,16 @@ resource "proxmox_virtual_environment_vm" "talos_worker1" { } network_device { - bridge = var.network_bridge + bridge = var.network_bridge + mac_address = "BC:24:11:43:3F:FF" } - lifecycle { - ignore_changes = [ - network_device, - ] + vga { + type = "std" + } + + agent { + enabled = true } } @@ -148,13 +160,16 @@ resource "proxmox_virtual_environment_vm" "talos_worker2" { } network_device { - bridge = var.network_bridge + bridge = var.network_bridge + mac_address = "BC:24:11:62:C4:8F" } - lifecycle { - ignore_changes = [ - network_device, - ] + vga { + type = "std" + } + + agent { + enabled = true } } @@ -180,12 +195,15 @@ resource "proxmox_virtual_environment_vm" "talos_worker3" { } network_device { - bridge = var.network_bridge + bridge = var.network_bridge + mac_address = "BC:24:11:3F:8E:1A" } - lifecycle { - ignore_changes = [ - network_device, - ] + vga { + type = "std" + } + + agent { + enabled = true } } diff --git a/terraform/variables.tf b/terraform/variables.tf index cbad05d..4bc72ef 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -22,7 +22,7 @@ variable "control_plane_count" { variable "control_plane_cores" { description = "Number of CPU cores for control plane nodes" type = number - default = 2 + default = 4 } variable "control_plane_memory" {