fix vntx cnames
This commit is contained in:
parent
888112348c
commit
b951c77015
19 changed files with 2978 additions and 53 deletions
|
|
@ -18,6 +18,8 @@ mcintire_me_zone:
|
||||||
ip: 107.174.178.20
|
ip: 107.174.178.20
|
||||||
- name: photos
|
- name: photos
|
||||||
ip: 204.110.191.8
|
ip: 204.110.191.8
|
||||||
|
- name: "pangolin"
|
||||||
|
ip: 172.245.56.83
|
||||||
other_name_servers:
|
other_name_servers:
|
||||||
- autodiscover.mcintire.me. IN CNAME mail.w5isp.com.
|
- autodiscover.mcintire.me. IN CNAME mail.w5isp.com.
|
||||||
- autoconfig.mcintire.me. IN CNAME mail.w5isp.com.
|
- autoconfig.mcintire.me. IN CNAME mail.w5isp.com.
|
||||||
|
|
|
||||||
|
|
@ -72,6 +72,38 @@ vntx_net_zone:
|
||||||
ip: 204.110.191.224
|
ip: 204.110.191.224
|
||||||
- name: dns
|
- name: dns
|
||||||
ip: 204.110.191.193
|
ip: 204.110.191.193
|
||||||
|
other_name_servers:
|
||||||
|
- mg.vntx.net. IN CNAME mailgun.org.
|
||||||
|
- email.mg.vntx.net. IN CNAME mailgun.org.
|
||||||
|
- mail.speedtest.vntx.net. IN CNAME mail.speedtest.vntx.net.s2.mailersendapp.com.
|
||||||
|
- status.vntx.net. IN CNAME stats.uptimerobot.com.
|
||||||
|
- ntp.vntx.net. IN CNAME 0.us.pool.ntp.org.
|
||||||
|
- iptrack.vntx.net. IN CNAME dokku.w5isp.com.
|
||||||
|
- _83337805c305955c6823504cc5e6ca29.vntx.net. IN CNAME _baf97cdcc7b6458fa5719e4261e9932f.sdgjtdhdhz.acm-validations.aws.
|
||||||
|
- 177982.vntx.net. IN CNAME sendgrid.net.
|
||||||
|
- 4809fce066c3da4d14197c7276ba083f.irc.vntx.net. IN CNAME b58bf151af520d34d8fad99d05274cb536893031.comodoca.com.
|
||||||
|
- 9p83fpanfdgs8xdgcnzd.vntx.net. IN CNAME verify.squarespace.com.
|
||||||
|
- activate.vntx.net. IN CNAME verona-networks-checkout.gaiia-consumer.com.
|
||||||
|
- autodiscover.o365.vntx.net. IN CNAME autodiscover.outlook.com.
|
||||||
|
- autodiscover.vntx.net. IN CNAME autodiscover.outlook.com.
|
||||||
|
- em924886.vntx.net. IN CNAME return.smtp2go.net.
|
||||||
|
- em9279.vntx.net. IN CNAME u177982.wl233.sendgrid.net.
|
||||||
|
- email.vntx.net. IN CNAME mandrillapp.com.
|
||||||
|
- enterpriseenrollment.o365.vntx.net. IN CNAME enterpriseenrollment.manage.microsoft.com.
|
||||||
|
- enterpriseregistration.o365.vntx.net. IN CNAME enterpriseregistration.windows.net.
|
||||||
|
- link.vntx.net. IN CNAME track.smtp2go.net.
|
||||||
|
- lyncdiscover.o365.vntx.net. IN CNAME webdir.online.lync.com.
|
||||||
|
- mte1._domainkey.vntx.net. IN CNAME dkim1.mandrillapp.com.
|
||||||
|
- mte2._domainkey.vntx.net. IN CNAME dkim2.mandrillapp.com.
|
||||||
|
- portal.vntx.net. IN CNAME verona-networks-clientportal.gaiia-consumer.com.
|
||||||
|
- s1._domainkey.vntx.net. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net.
|
||||||
|
- s2._domainkey.vntx.net. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net.
|
||||||
|
- s924886._domainkey.vntx.net. IN CNAME dkim.smtp2go.net.
|
||||||
|
- sip.o365.vntx.net. IN CNAME sipdir.online.lync.com.
|
||||||
|
- uptime.vntx.net. IN CNAME page.updown.io.
|
||||||
|
- url62.vntx.net. IN CNAME sendgrid.net.
|
||||||
|
- url9812.vntx.net. IN CNAME sendgrid.net.
|
||||||
|
- www.vntx.net. IN CNAME ext-cust.squarespace.com.
|
||||||
text:
|
text:
|
||||||
- name: "@"
|
- name: "@"
|
||||||
text: '"v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"'
|
text: '"v=spf1 include:spf.protection.outlook.com include:mailgun.org -all"'
|
||||||
|
|
|
||||||
|
|
@ -2,3 +2,5 @@ apiVersion: v1
|
||||||
kind: Namespace
|
kind: Namespace
|
||||||
metadata:
|
metadata:
|
||||||
name: ceph-csi-rbd
|
name: ceph-csi-rbd
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
|
|
||||||
2
cluster/ceph-csi/talosconfig
Normal file
2
cluster/ceph-csi/talosconfig
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
context: ""
|
||||||
|
contexts: {}
|
||||||
|
|
@ -3,6 +3,8 @@ apiVersion: v1
|
||||||
kind: Namespace
|
kind: Namespace
|
||||||
metadata:
|
metadata:
|
||||||
name: pangolin
|
name: pangolin
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Secret
|
kind: Secret
|
||||||
|
|
@ -11,8 +13,8 @@ metadata:
|
||||||
namespace: pangolin
|
namespace: pangolin
|
||||||
type: Opaque
|
type: Opaque
|
||||||
stringData:
|
stringData:
|
||||||
NEWT_ID: "mz1ixml2gg3vezk"
|
NEWT_ID: "ouni3kkg688rt5q"
|
||||||
NEWT_SECRET: "0zwoklb1esw269r2pyf4x65dn0llgl8nnsdssmnzqbkwkv00"
|
NEWT_SECRET: "i2rzel1tohf96bq8o8jmy6ky7kn9euz01f70uerrarc61hlo"
|
||||||
PANGOLIN_ENDPOINT: "https://pangolin.w5isp.com"
|
PANGOLIN_ENDPOINT: "https://pangolin.w5isp.com"
|
||||||
---
|
---
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
|
|
|
||||||
313
talos/CLAUDE.md
Normal file
313
talos/CLAUDE.md
Normal file
|
|
@ -0,0 +1,313 @@
|
||||||
|
# Talos Cluster Setup Guide
|
||||||
|
|
||||||
|
This document contains notes on how the Talos home cluster was created and how to recreate it in the future.
|
||||||
|
|
||||||
|
## Cluster Information
|
||||||
|
|
||||||
|
- **Cluster Name**: home-cluster
|
||||||
|
- **Kubernetes Version**: v1.35.0
|
||||||
|
- **Talos Version**: v1.12.1
|
||||||
|
- **Control Plane Nodes**: 3 (10.0.15.1-3)
|
||||||
|
- **Worker Nodes**: 3 (10.0.15.4-6)
|
||||||
|
- **API Endpoint**: https://10.0.15.1:6443
|
||||||
|
|
||||||
|
## Node Details
|
||||||
|
|
||||||
|
| Hostname | Role | IP | Proxmox Node | VMID | MAC Address |
|
||||||
|
|----------|------|-----|--------------|------|-------------|
|
||||||
|
| talos-cp1 | Control Plane | 10.0.15.1 | node1 | 200 | BC:24:11:9B:48:92 |
|
||||||
|
| talos-cp2 | Control Plane | 10.0.15.2 | node2 | 201 | BC:24:11:62:7B:3F |
|
||||||
|
| talos-cp3 | Control Plane | 10.0.15.3 | node3 | 202 | BC:24:11:D4:2F:ED |
|
||||||
|
| talos-worker1 | Worker | 10.0.15.4 | node1 | 210 | BC:24:11:43:3F:FF |
|
||||||
|
| talos-worker2 | Worker | 10.0.15.5 | node2 | 211 | BC:24:11:62:C4:8F |
|
||||||
|
| talos-worker3 | Worker | 10.0.15.6 | node3 | 212 | BC:24:11:3F:8E:1A |
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- Proxmox home cluster with nodes: node1, node2, node3 (10.0.15.101-103)
|
||||||
|
- Talos Linux template at VMID 9001 on node1
|
||||||
|
- DHCP static leases configured for all MAC addresses above
|
||||||
|
- Terraform/OpenTofu configured with Proxmox provider
|
||||||
|
- talosctl CLI installed
|
||||||
|
|
||||||
|
## Complete Cluster Creation Process
|
||||||
|
|
||||||
|
### 1. Generate New Cluster Secrets
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /Users/graham/dev/infra/talos
|
||||||
|
talosctl gen secrets -o secrets.yaml --force
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Generate Node-Specific Configurations
|
||||||
|
|
||||||
|
Each node needs a configuration with its specific hostname. Use patch files to set hostnames:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkdir -p configs
|
||||||
|
|
||||||
|
# Generate control plane configs
|
||||||
|
for i in 1 2 3; do
|
||||||
|
cat > /tmp/cp${i}-patch.yaml <<EOF
|
||||||
|
machine:
|
||||||
|
network:
|
||||||
|
hostname: talos-cp${i}
|
||||||
|
EOF
|
||||||
|
talosctl gen config home-cluster https://10.0.15.1:6443 \
|
||||||
|
--with-secrets secrets.yaml \
|
||||||
|
--kubernetes-version v1.35.0 \
|
||||||
|
--output-types controlplane \
|
||||||
|
--output configs/talos-cp${i}.yaml \
|
||||||
|
--config-patch /tmp/cp${i}-patch.yaml
|
||||||
|
done
|
||||||
|
|
||||||
|
# Generate worker configs
|
||||||
|
for i in 1 2 3; do
|
||||||
|
cat > /tmp/w${i}-patch.yaml <<EOF
|
||||||
|
machine:
|
||||||
|
network:
|
||||||
|
hostname: talos-worker${i}
|
||||||
|
EOF
|
||||||
|
talosctl gen config home-cluster https://10.0.15.1:6443 \
|
||||||
|
--with-secrets secrets.yaml \
|
||||||
|
--kubernetes-version v1.35.0 \
|
||||||
|
--output-types worker \
|
||||||
|
--output configs/talos-worker${i}.yaml \
|
||||||
|
--config-patch /tmp/w${i}-patch.yaml
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Fix HostnameConfig Sections
|
||||||
|
|
||||||
|
The generated configs will have both `machine.network.hostname` and a `HostnameConfig` document. Fix this:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Remove hostname from machine.network section
|
||||||
|
for file in configs/*.yaml; do
|
||||||
|
sed -i '' '/^ network:$/,/^ # # Configures KubeSpan/{
|
||||||
|
/^ hostname:/d
|
||||||
|
}' "$file"
|
||||||
|
done
|
||||||
|
|
||||||
|
# Update HostnameConfig sections
|
||||||
|
sed -i '' '/^apiVersion: v1alpha1$/,/^# hostname:.*/{
|
||||||
|
/^kind: HostnameConfig$/,/^# hostname:.*/c\
|
||||||
|
kind: HostnameConfig\
|
||||||
|
hostname: talos-cp1
|
||||||
|
}' configs/talos-cp1.yaml
|
||||||
|
|
||||||
|
sed -i '' '/^apiVersion: v1alpha1$/,/^# hostname:.*/{
|
||||||
|
/^kind: HostnameConfig$/,/^# hostname:.*/c\
|
||||||
|
kind: HostnameConfig\
|
||||||
|
hostname: talos-cp2
|
||||||
|
}' configs/talos-cp2.yaml
|
||||||
|
|
||||||
|
sed -i '' '/^apiVersion: v1alpha1$/,/^# hostname:.*/{
|
||||||
|
/^kind: HostnameConfig$/,/^# hostname:.*/c\
|
||||||
|
kind: HostnameConfig\
|
||||||
|
hostname: talos-cp3
|
||||||
|
}' configs/talos-cp3.yaml
|
||||||
|
|
||||||
|
sed -i '' '/^apiVersion: v1alpha1$/,/^# hostname:.*/{
|
||||||
|
/^kind: HostnameConfig$/,/^# hostname:.*/c\
|
||||||
|
kind: HostnameConfig\
|
||||||
|
hostname: talos-worker1
|
||||||
|
}' configs/talos-worker1.yaml
|
||||||
|
|
||||||
|
sed -i '' '/^apiVersion: v1alpha1$/,/^# hostname:.*/{
|
||||||
|
/^kind: HostnameConfig$/,/^# hostname:.*/c\
|
||||||
|
kind: HostnameConfig\
|
||||||
|
hostname: talos-worker2
|
||||||
|
}' configs/talos-worker2.yaml
|
||||||
|
|
||||||
|
sed -i '' '/^apiVersion: v1alpha1$/,/^# hostname:.*/{
|
||||||
|
/^kind: HostnameConfig$/,/^# hostname:.*/c\
|
||||||
|
kind: HostnameConfig\
|
||||||
|
hostname: talos-worker3
|
||||||
|
}' configs/talos-worker3.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. Deploy VMs via Terraform
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /Users/graham/dev/infra/terraform
|
||||||
|
source .envrc # Load environment variables
|
||||||
|
|
||||||
|
# If recreating, destroy old VMs first
|
||||||
|
tofu destroy \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_cp1 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_cp2 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_cp3 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_worker1 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_worker2 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_worker3 \
|
||||||
|
-auto-approve
|
||||||
|
|
||||||
|
# Create new VMs
|
||||||
|
tofu apply \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_cp1 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_cp2 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_cp3 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_worker1 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_worker2 \
|
||||||
|
-target=proxmox_virtual_environment_vm.talos_worker3 \
|
||||||
|
-auto-approve
|
||||||
|
```
|
||||||
|
|
||||||
|
### 5. Wait for VMs to Boot
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /Users/graham/dev/infra/talos
|
||||||
|
sleep 30
|
||||||
|
|
||||||
|
# Verify all nodes are up
|
||||||
|
for ip in 10.0.15.{1..6}; do
|
||||||
|
echo -n "$ip: "
|
||||||
|
ping -c 1 -W 2 $ip > /dev/null 2>&1 && echo "up" || echo "down"
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
|
### 6. Apply Talos Configuration to All Nodes
|
||||||
|
|
||||||
|
```bash
|
||||||
|
talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.1 --file configs/talos-cp1.yaml --insecure
|
||||||
|
talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.2 --file configs/talos-cp2.yaml --insecure
|
||||||
|
talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.3 --file configs/talos-cp3.yaml --insecure
|
||||||
|
talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.4 --file configs/talos-worker1.yaml --insecure
|
||||||
|
talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.5 --file configs/talos-worker2.yaml --insecure
|
||||||
|
talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.6 --file configs/talos-worker3.yaml --insecure
|
||||||
|
```
|
||||||
|
|
||||||
|
### 7. Bootstrap the Cluster
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Set talosctl endpoints
|
||||||
|
talosctl --talosconfig talosconfig config endpoint 10.0.15.1 10.0.15.2 10.0.15.3
|
||||||
|
|
||||||
|
# Bootstrap Kubernetes on the first control plane node
|
||||||
|
talosctl --talosconfig talosconfig bootstrap --nodes 10.0.15.1
|
||||||
|
```
|
||||||
|
|
||||||
|
### 8. Retrieve Kubeconfig
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Wait for cluster to initialize (about 60 seconds)
|
||||||
|
sleep 60
|
||||||
|
|
||||||
|
# Retrieve and merge kubeconfig
|
||||||
|
talosctl --talosconfig talosconfig kubeconfig --nodes 10.0.15.1 --force
|
||||||
|
|
||||||
|
# Switch to the cluster
|
||||||
|
kubectl config use-context admin@home-cluster
|
||||||
|
```
|
||||||
|
|
||||||
|
### 9. Verify Cluster
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Wait for all nodes to be Ready
|
||||||
|
kubectl get nodes -o wide
|
||||||
|
|
||||||
|
# Check all system pods are running
|
||||||
|
kubectl get pods -A
|
||||||
|
|
||||||
|
# Verify node names
|
||||||
|
kubectl get nodes
|
||||||
|
# Expected output:
|
||||||
|
# NAME STATUS ROLES AGE VERSION
|
||||||
|
# talos-cp1 Ready control-plane ... v1.35.0
|
||||||
|
# talos-cp2 Ready control-plane ... v1.35.0
|
||||||
|
# talos-cp3 Ready control-plane ... v1.35.0
|
||||||
|
# talos-worker1 Ready <none> ... v1.35.0
|
||||||
|
# talos-worker2 Ready <none> ... v1.35.0
|
||||||
|
# talos-worker3 Ready <none> ... v1.35.0
|
||||||
|
```
|
||||||
|
|
||||||
|
## Important Files
|
||||||
|
|
||||||
|
- `secrets.yaml` - Cluster secrets (CRITICAL - keep secure and backed up!)
|
||||||
|
- `talosconfig` - Talosctl client configuration
|
||||||
|
- `configs/talos-cp*.yaml` - Control plane node configurations
|
||||||
|
- `configs/talos-worker*.yaml` - Worker node configurations
|
||||||
|
- `~/.kube/config` - Contains merged kubeconfig with admin@home-cluster context
|
||||||
|
|
||||||
|
## Key Lessons Learned
|
||||||
|
|
||||||
|
1. **Hostname Configuration**: Talos uses two places for hostname:
|
||||||
|
- `machine.network.hostname` (for machine config)
|
||||||
|
- `HostnameConfig` document (v1alpha1 config)
|
||||||
|
- Only ONE should be set. Use `HostnameConfig` document with `hostname:` field for static names.
|
||||||
|
|
||||||
|
2. **Template Considerations**: The Talos template (VMID 9001) has `HostnameConfig.auto: stable` which auto-generates hostnames. When applying custom configs, this needs to be overridden.
|
||||||
|
|
||||||
|
3. **Terraform Environment**: Always `source .envrc` before running terraform commands to load backend configuration.
|
||||||
|
|
||||||
|
4. **Bootstrap Process**: Bootstrap must happen AFTER all control plane nodes have configs applied, but BEFORE retrieving kubeconfig.
|
||||||
|
|
||||||
|
5. **Node Naming**: Kubernetes node names come from the Talos hostname configuration, not VM names in Proxmox.
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
### Nodes won't accept new config
|
||||||
|
|
||||||
|
If seeing "static hostname is already set" error:
|
||||||
|
- Ensure only `HostnameConfig` document has hostname, not `machine.network.hostname`
|
||||||
|
- Use `--mode=reboot` or recreate the VM entirely
|
||||||
|
|
||||||
|
### Can't connect with talosctl
|
||||||
|
|
||||||
|
Set endpoints explicitly:
|
||||||
|
```bash
|
||||||
|
talosctl --talosconfig talosconfig config endpoint 10.0.15.1 10.0.15.2 10.0.15.3
|
||||||
|
```
|
||||||
|
|
||||||
|
### Nodes not appearing in kubectl
|
||||||
|
|
||||||
|
Wait 1-2 minutes after bootstrap. Check:
|
||||||
|
```bash
|
||||||
|
talosctl --talosconfig talosconfig service --nodes 10.0.15.1
|
||||||
|
# Look for kubelet, etcd, apid as "Running"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Networking
|
||||||
|
|
||||||
|
- **CNI**: Flannel (deployed automatically)
|
||||||
|
- **Service CIDR**: 10.96.0.0/12
|
||||||
|
- **Pod CIDR**: 10.244.0.0/16
|
||||||
|
- **DNS**: CoreDNS (cluster.local domain)
|
||||||
|
|
||||||
|
## Storage
|
||||||
|
|
||||||
|
Nodes use Proxmox Ceph for VM disks. For Kubernetes persistent storage, deploy:
|
||||||
|
- Ceph CSI driver (to use Proxmox Ceph directly)
|
||||||
|
- Or Longhorn for cluster-managed storage
|
||||||
|
|
||||||
|
## Maintenance
|
||||||
|
|
||||||
|
### Adding a Node
|
||||||
|
|
||||||
|
1. Add VM definition to `terraform/talos_vms.tf`
|
||||||
|
2. Run `tofu apply`
|
||||||
|
3. Generate config with appropriate hostname
|
||||||
|
4. Apply config: `talosctl apply-config --nodes <IP> --file <config>.yaml --insecure`
|
||||||
|
|
||||||
|
### Upgrading Talos
|
||||||
|
|
||||||
|
```bash
|
||||||
|
talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.X.Y
|
||||||
|
```
|
||||||
|
|
||||||
|
### Upgrading Kubernetes
|
||||||
|
|
||||||
|
```bash
|
||||||
|
talosctl --talosconfig talosconfig upgrade-k8s --to 1.XX.0
|
||||||
|
```
|
||||||
|
|
||||||
|
## Backup Strategy
|
||||||
|
|
||||||
|
Essential files to backup:
|
||||||
|
1. `secrets.yaml` - Cannot recover cluster without this
|
||||||
|
2. `talosconfig` - Required for talosctl access
|
||||||
|
3. Node configs in `configs/` directory
|
||||||
|
4. Terraform state (stored in GitLab HTTP backend)
|
||||||
|
|
||||||
|
Store securely in password manager or encrypted backup location.
|
||||||
407
talos/configs/talos-cp1.yaml
Normal file
407
talos/configs/talos-cp1.yaml
Normal file
|
|
@ -0,0 +1,407 @@
|
||||||
|
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||||
|
debug: false # Enable verbose logging to the console.
|
||||||
|
persist: true
|
||||||
|
# Provides machine specific configuration options.
|
||||||
|
machine:
|
||||||
|
type: controlplane # Defines the role of the machine within the cluster.
|
||||||
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
|
# The root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
|
certSANs: []
|
||||||
|
# # Uncomment this to enable SANs.
|
||||||
|
# - 10.0.0.10
|
||||||
|
# - 172.16.0.10
|
||||||
|
# - 192.168.0.10
|
||||||
|
|
||||||
|
# Used to provide additional options to the kubelet.
|
||||||
|
kubelet:
|
||||||
|
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||||
|
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||||
|
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||||
|
|
||||||
|
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||||
|
# clusterDNS:
|
||||||
|
# - 10.96.0.10
|
||||||
|
# - 169.254.2.53
|
||||||
|
|
||||||
|
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||||
|
# extraArgs:
|
||||||
|
# key: value
|
||||||
|
|
||||||
|
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||||
|
# extraMounts:
|
||||||
|
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||||
|
# type: bind # Type specifies the mount kind.
|
||||||
|
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||||
|
# # Options are fstab style mount options.
|
||||||
|
# options:
|
||||||
|
# - bind
|
||||||
|
# - rshared
|
||||||
|
# - rw
|
||||||
|
|
||||||
|
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||||
|
# extraConfig:
|
||||||
|
# serverTLSBootstrap: true
|
||||||
|
|
||||||
|
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||||
|
# credentialProviderConfig:
|
||||||
|
# apiVersion: kubelet.config.k8s.io/v1
|
||||||
|
# kind: CredentialProviderConfig
|
||||||
|
# providers:
|
||||||
|
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||||
|
# defaultCacheDuration: 12h
|
||||||
|
# matchImages:
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||||
|
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||||
|
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||||
|
# name: ecr-credential-provider
|
||||||
|
|
||||||
|
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||||
|
# nodeIP:
|
||||||
|
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||||
|
# validSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - '!10.0.0.3/32'
|
||||||
|
# - fdc7::/16
|
||||||
|
# Provides machine specific network configuration options.
|
||||||
|
network:
|
||||||
|
|
||||||
|
# # Configures KubeSpan feature.
|
||||||
|
# kubespan:
|
||||||
|
# enabled: true # Enable the KubeSpan feature.
|
||||||
|
# Used to provide instructions for installations.
|
||||||
|
install:
|
||||||
|
disk: /dev/sda # The disk used for installations.
|
||||||
|
image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation.
|
||||||
|
extensions:
|
||||||
|
- image: ghcr.io/siderolabs/tailscale:1.82.1
|
||||||
|
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||||
|
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||||
|
extraKernelArgs:
|
||||||
|
- console=tty0
|
||||||
|
|
||||||
|
# # Look up disk using disk attributes like model, size, serial and others.
|
||||||
|
# diskSelector:
|
||||||
|
# size: 4GB # Disk size.
|
||||||
|
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||||
|
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||||
|
# Features describe individual Talos features that can be switched on or off.
|
||||||
|
features:
|
||||||
|
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||||
|
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||||
|
kubePrism:
|
||||||
|
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||||
|
port: 7445 # KubePrism port.
|
||||||
|
# Configures host DNS caching resolver.
|
||||||
|
hostDNS:
|
||||||
|
enabled: true # Enable host DNS caching resolver.
|
||||||
|
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||||
|
|
||||||
|
# # Configure Talos API access from Kubernetes pods.
|
||||||
|
# kubernetesTalosAPIAccess:
|
||||||
|
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||||
|
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||||
|
# allowedRoles:
|
||||||
|
# - os:reader
|
||||||
|
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||||
|
# allowedKubernetesNamespaces:
|
||||||
|
# - kube-system
|
||||||
|
# Configures the node labels for the machine.
|
||||||
|
nodeLabels:
|
||||||
|
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
||||||
|
|
||||||
|
# # Provides machine specific control plane configuration options.
|
||||||
|
|
||||||
|
# # ControlPlane definition example.
|
||||||
|
# controlPlane:
|
||||||
|
# # Controller manager machine specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# disabled: false # Disable kube-controller-manager on the node.
|
||||||
|
# # Scheduler machine specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# disabled: true # Disable kube-scheduler on the node.
|
||||||
|
|
||||||
|
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||||
|
|
||||||
|
# # nginx static pod.
|
||||||
|
# pods:
|
||||||
|
# - apiVersion: v1
|
||||||
|
# kind: pod
|
||||||
|
# metadata:
|
||||||
|
# name: nginx
|
||||||
|
# spec:
|
||||||
|
# containers:
|
||||||
|
# - image: nginx
|
||||||
|
# name: nginx
|
||||||
|
|
||||||
|
# # Allows the addition of user specified files.
|
||||||
|
|
||||||
|
# # MachineFiles usage example.
|
||||||
|
# files:
|
||||||
|
# - content: '...' # The contents of the file.
|
||||||
|
# permissions: 0o666 # The file's permissions in octal.
|
||||||
|
# path: /tmp/file.txt # The path of the file.
|
||||||
|
# op: append # The operation to use
|
||||||
|
|
||||||
|
# # The `env` field allows for the addition of environment variables.
|
||||||
|
|
||||||
|
# # Environment variables definition examples.
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||||
|
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||||
|
# https_proxy: http://SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||||
|
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysctls.
|
||||||
|
|
||||||
|
# # MachineSysctls usage example.
|
||||||
|
# sysctls:
|
||||||
|
# kernel.domainname: talos.dev
|
||||||
|
# net.ipv4.ip_forward: "0"
|
||||||
|
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysfs.
|
||||||
|
|
||||||
|
# # MachineSysfs usage example.
|
||||||
|
# sysfs:
|
||||||
|
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||||
|
|
||||||
|
# # Configures the udev system.
|
||||||
|
# udev:
|
||||||
|
# # List of udev rules to apply to the udev system
|
||||||
|
# rules:
|
||||||
|
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||||
|
|
||||||
|
# # Configures the logging system.
|
||||||
|
# logging:
|
||||||
|
# # Logging destination.
|
||||||
|
# destinations:
|
||||||
|
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||||
|
# format: json_lines # Logs format.
|
||||||
|
|
||||||
|
# # Configures the kernel.
|
||||||
|
# kernel:
|
||||||
|
# # Kernel modules to load.
|
||||||
|
# modules:
|
||||||
|
# - name: btrfs # Module name.
|
||||||
|
|
||||||
|
# # Configures the seccomp profiles for the machine.
|
||||||
|
# seccompProfiles:
|
||||||
|
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||||
|
# # The `value` field is used to provide the seccomp profile.
|
||||||
|
# value:
|
||||||
|
# defaultAction: SCMP_ACT_LOG
|
||||||
|
|
||||||
|
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||||
|
|
||||||
|
# # override default open file limit
|
||||||
|
# baseRuntimeSpecOverrides:
|
||||||
|
# process:
|
||||||
|
# rlimits:
|
||||||
|
# - hard: 1024
|
||||||
|
# soft: 1024
|
||||||
|
# type: RLIMIT_NOFILE
|
||||||
|
|
||||||
|
# # Configures the node annotations for the machine.
|
||||||
|
|
||||||
|
# # node annotations example.
|
||||||
|
# nodeAnnotations:
|
||||||
|
# customer.io/rack: r13a25
|
||||||
|
|
||||||
|
# # Configures the node taints for the machine. Effect is optional.
|
||||||
|
|
||||||
|
# # node taints example.
|
||||||
|
# nodeTaints:
|
||||||
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
|
# Provides cluster specific configuration options.
|
||||||
|
cluster:
|
||||||
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
|
# Provides control plane specific configuration options.
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
clusterName: home-cluster # Configures the cluster's name.
|
||||||
|
# Provides cluster specific network configuration options.
|
||||||
|
network:
|
||||||
|
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||||
|
# The pod subnet CIDR.
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
# The service subnet CIDR.
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
|
||||||
|
# # The CNI used.
|
||||||
|
# cni:
|
||||||
|
# name: custom # Name of CNI to use.
|
||||||
|
# # URLs containing manifests to apply for the CNI.
|
||||||
|
# urls:
|
||||||
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
|
secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
|
aggregatorCA:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
# The base64 encoded private key for service account token generation.
|
||||||
|
serviceAccount:
|
||||||
|
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
# API server specific configuration options.
|
||||||
|
apiServer:
|
||||||
|
image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
# Configure the API server admission plugins.
|
||||||
|
admissionControl:
|
||||||
|
- name: PodSecurity # Name is the name of the admission controller.
|
||||||
|
# Configuration is an embedded configuration object to be used as the plugin's
|
||||||
|
configuration:
|
||||||
|
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||||
|
defaults:
|
||||||
|
audit: restricted
|
||||||
|
audit-version: latest
|
||||||
|
enforce: baseline
|
||||||
|
enforce-version: latest
|
||||||
|
warn: restricted
|
||||||
|
warn-version: latest
|
||||||
|
exemptions:
|
||||||
|
namespaces:
|
||||||
|
- kube-system
|
||||||
|
runtimeClasses: []
|
||||||
|
usernames: []
|
||||||
|
kind: PodSecurityConfiguration
|
||||||
|
# Configure the API server audit policy.
|
||||||
|
auditPolicy:
|
||||||
|
apiVersion: audit.k8s.io/v1
|
||||||
|
kind: Policy
|
||||||
|
rules:
|
||||||
|
- level: Metadata
|
||||||
|
|
||||||
|
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||||
|
# authorizationConfig:
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: webhook # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: Deny
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# matchConditions:
|
||||||
|
# - expression: has(request.resourceAttributes)
|
||||||
|
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: NoOpinion
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# Controller manager server specific configuration options.
|
||||||
|
controllerManager:
|
||||||
|
image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
||||||
|
# Kube-proxy server-specific configuration options
|
||||||
|
proxy:
|
||||||
|
image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
||||||
|
|
||||||
|
# # Disable kube-proxy deployment on cluster bootstrap.
|
||||||
|
# disabled: false
|
||||||
|
# Scheduler server specific configuration options.
|
||||||
|
scheduler:
|
||||||
|
image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
||||||
|
# Configures cluster member discovery.
|
||||||
|
discovery:
|
||||||
|
enabled: true # Enable the cluster membership discovery feature.
|
||||||
|
# Configure registries used for cluster member discovery.
|
||||||
|
registries:
|
||||||
|
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||||
|
kubernetes:
|
||||||
|
disabled: true # Disable Kubernetes discovery registry.
|
||||||
|
# Service registry is using an external service to push and pull information about cluster members.
|
||||||
|
service: {}
|
||||||
|
# # External service endpoint.
|
||||||
|
# endpoint: https://discovery.talos.dev/
|
||||||
|
# Etcd specific configuration options.
|
||||||
|
etcd:
|
||||||
|
# The `ca` is the root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
|
||||||
|
# # The container image used to create the etcd service.
|
||||||
|
# image: registry.k8s.io/etcd:v3.6.7
|
||||||
|
|
||||||
|
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||||
|
# advertisedSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# A list of urls that point to additional manifests.
|
||||||
|
extraManifests: []
|
||||||
|
# - https://www.example.com/manifest1.yaml
|
||||||
|
# - https://www.example.com/manifest2.yaml
|
||||||
|
|
||||||
|
# A list of inline Kubernetes manifests.
|
||||||
|
inlineManifests: []
|
||||||
|
# - name: namespace-ci # Name of the manifest.
|
||||||
|
# contents: |- # Manifest contents as a string.
|
||||||
|
# apiVersion: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# metadata:
|
||||||
|
# name: ci
|
||||||
|
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # Core DNS specific configuration options.
|
||||||
|
# coreDNS:
|
||||||
|
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
||||||
|
|
||||||
|
# # External cloud provider configuration.
|
||||||
|
# externalCloudProvider:
|
||||||
|
# enabled: true # Enable external cloud provider.
|
||||||
|
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||||
|
# manifests:
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||||
|
|
||||||
|
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||||
|
# extraManifestHeaders:
|
||||||
|
# Token: "1234567"
|
||||||
|
# X-ExtraInfo: info
|
||||||
|
|
||||||
|
# # Settings for admin kubeconfig generation.
|
||||||
|
# adminKubeconfig:
|
||||||
|
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||||
|
|
||||||
|
# # Allows running workload on control-plane nodes.
|
||||||
|
# allowSchedulingOnControlPlanes: true
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
hostname: talos-cp1
|
||||||
|
# hostname: controlplane1.example.org
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: ExtensionServiceConfig
|
||||||
|
name: tailscale # Name of the extension service.
|
||||||
|
# The environment for the extension service.
|
||||||
|
environment:
|
||||||
|
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||||
407
talos/configs/talos-cp2.yaml
Normal file
407
talos/configs/talos-cp2.yaml
Normal file
|
|
@ -0,0 +1,407 @@
|
||||||
|
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||||
|
debug: false # Enable verbose logging to the console.
|
||||||
|
persist: true
|
||||||
|
# Provides machine specific configuration options.
|
||||||
|
machine:
|
||||||
|
type: controlplane # Defines the role of the machine within the cluster.
|
||||||
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
|
# The root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
|
certSANs: []
|
||||||
|
# # Uncomment this to enable SANs.
|
||||||
|
# - 10.0.0.10
|
||||||
|
# - 172.16.0.10
|
||||||
|
# - 192.168.0.10
|
||||||
|
|
||||||
|
# Used to provide additional options to the kubelet.
|
||||||
|
kubelet:
|
||||||
|
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||||
|
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||||
|
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||||
|
|
||||||
|
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||||
|
# clusterDNS:
|
||||||
|
# - 10.96.0.10
|
||||||
|
# - 169.254.2.53
|
||||||
|
|
||||||
|
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||||
|
# extraArgs:
|
||||||
|
# key: value
|
||||||
|
|
||||||
|
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||||
|
# extraMounts:
|
||||||
|
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||||
|
# type: bind # Type specifies the mount kind.
|
||||||
|
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||||
|
# # Options are fstab style mount options.
|
||||||
|
# options:
|
||||||
|
# - bind
|
||||||
|
# - rshared
|
||||||
|
# - rw
|
||||||
|
|
||||||
|
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||||
|
# extraConfig:
|
||||||
|
# serverTLSBootstrap: true
|
||||||
|
|
||||||
|
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||||
|
# credentialProviderConfig:
|
||||||
|
# apiVersion: kubelet.config.k8s.io/v1
|
||||||
|
# kind: CredentialProviderConfig
|
||||||
|
# providers:
|
||||||
|
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||||
|
# defaultCacheDuration: 12h
|
||||||
|
# matchImages:
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||||
|
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||||
|
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||||
|
# name: ecr-credential-provider
|
||||||
|
|
||||||
|
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||||
|
# nodeIP:
|
||||||
|
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||||
|
# validSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - '!10.0.0.3/32'
|
||||||
|
# - fdc7::/16
|
||||||
|
# Provides machine specific network configuration options.
|
||||||
|
network:
|
||||||
|
|
||||||
|
# # Configures KubeSpan feature.
|
||||||
|
# kubespan:
|
||||||
|
# enabled: true # Enable the KubeSpan feature.
|
||||||
|
# Used to provide instructions for installations.
|
||||||
|
install:
|
||||||
|
disk: /dev/sda # The disk used for installations.
|
||||||
|
image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation.
|
||||||
|
extensions:
|
||||||
|
- image: ghcr.io/siderolabs/tailscale:1.82.1
|
||||||
|
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||||
|
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||||
|
extraKernelArgs:
|
||||||
|
- console=tty0
|
||||||
|
|
||||||
|
# # Look up disk using disk attributes like model, size, serial and others.
|
||||||
|
# diskSelector:
|
||||||
|
# size: 4GB # Disk size.
|
||||||
|
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||||
|
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||||
|
# Features describe individual Talos features that can be switched on or off.
|
||||||
|
features:
|
||||||
|
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||||
|
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||||
|
kubePrism:
|
||||||
|
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||||
|
port: 7445 # KubePrism port.
|
||||||
|
# Configures host DNS caching resolver.
|
||||||
|
hostDNS:
|
||||||
|
enabled: true # Enable host DNS caching resolver.
|
||||||
|
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||||
|
|
||||||
|
# # Configure Talos API access from Kubernetes pods.
|
||||||
|
# kubernetesTalosAPIAccess:
|
||||||
|
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||||
|
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||||
|
# allowedRoles:
|
||||||
|
# - os:reader
|
||||||
|
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||||
|
# allowedKubernetesNamespaces:
|
||||||
|
# - kube-system
|
||||||
|
# Configures the node labels for the machine.
|
||||||
|
nodeLabels:
|
||||||
|
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
||||||
|
|
||||||
|
# # Provides machine specific control plane configuration options.
|
||||||
|
|
||||||
|
# # ControlPlane definition example.
|
||||||
|
# controlPlane:
|
||||||
|
# # Controller manager machine specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# disabled: false # Disable kube-controller-manager on the node.
|
||||||
|
# # Scheduler machine specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# disabled: true # Disable kube-scheduler on the node.
|
||||||
|
|
||||||
|
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||||
|
|
||||||
|
# # nginx static pod.
|
||||||
|
# pods:
|
||||||
|
# - apiVersion: v1
|
||||||
|
# kind: pod
|
||||||
|
# metadata:
|
||||||
|
# name: nginx
|
||||||
|
# spec:
|
||||||
|
# containers:
|
||||||
|
# - image: nginx
|
||||||
|
# name: nginx
|
||||||
|
|
||||||
|
# # Allows the addition of user specified files.
|
||||||
|
|
||||||
|
# # MachineFiles usage example.
|
||||||
|
# files:
|
||||||
|
# - content: '...' # The contents of the file.
|
||||||
|
# permissions: 0o666 # The file's permissions in octal.
|
||||||
|
# path: /tmp/file.txt # The path of the file.
|
||||||
|
# op: append # The operation to use
|
||||||
|
|
||||||
|
# # The `env` field allows for the addition of environment variables.
|
||||||
|
|
||||||
|
# # Environment variables definition examples.
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||||
|
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||||
|
# https_proxy: http://SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||||
|
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysctls.
|
||||||
|
|
||||||
|
# # MachineSysctls usage example.
|
||||||
|
# sysctls:
|
||||||
|
# kernel.domainname: talos.dev
|
||||||
|
# net.ipv4.ip_forward: "0"
|
||||||
|
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysfs.
|
||||||
|
|
||||||
|
# # MachineSysfs usage example.
|
||||||
|
# sysfs:
|
||||||
|
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||||
|
|
||||||
|
# # Configures the udev system.
|
||||||
|
# udev:
|
||||||
|
# # List of udev rules to apply to the udev system
|
||||||
|
# rules:
|
||||||
|
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||||
|
|
||||||
|
# # Configures the logging system.
|
||||||
|
# logging:
|
||||||
|
# # Logging destination.
|
||||||
|
# destinations:
|
||||||
|
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||||
|
# format: json_lines # Logs format.
|
||||||
|
|
||||||
|
# # Configures the kernel.
|
||||||
|
# kernel:
|
||||||
|
# # Kernel modules to load.
|
||||||
|
# modules:
|
||||||
|
# - name: btrfs # Module name.
|
||||||
|
|
||||||
|
# # Configures the seccomp profiles for the machine.
|
||||||
|
# seccompProfiles:
|
||||||
|
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||||
|
# # The `value` field is used to provide the seccomp profile.
|
||||||
|
# value:
|
||||||
|
# defaultAction: SCMP_ACT_LOG
|
||||||
|
|
||||||
|
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||||
|
|
||||||
|
# # override default open file limit
|
||||||
|
# baseRuntimeSpecOverrides:
|
||||||
|
# process:
|
||||||
|
# rlimits:
|
||||||
|
# - hard: 1024
|
||||||
|
# soft: 1024
|
||||||
|
# type: RLIMIT_NOFILE
|
||||||
|
|
||||||
|
# # Configures the node annotations for the machine.
|
||||||
|
|
||||||
|
# # node annotations example.
|
||||||
|
# nodeAnnotations:
|
||||||
|
# customer.io/rack: r13a25
|
||||||
|
|
||||||
|
# # Configures the node taints for the machine. Effect is optional.
|
||||||
|
|
||||||
|
# # node taints example.
|
||||||
|
# nodeTaints:
|
||||||
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
|
# Provides cluster specific configuration options.
|
||||||
|
cluster:
|
||||||
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
|
# Provides control plane specific configuration options.
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
clusterName: home-cluster # Configures the cluster's name.
|
||||||
|
# Provides cluster specific network configuration options.
|
||||||
|
network:
|
||||||
|
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||||
|
# The pod subnet CIDR.
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
# The service subnet CIDR.
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
|
||||||
|
# # The CNI used.
|
||||||
|
# cni:
|
||||||
|
# name: custom # Name of CNI to use.
|
||||||
|
# # URLs containing manifests to apply for the CNI.
|
||||||
|
# urls:
|
||||||
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
|
secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
|
aggregatorCA:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
# The base64 encoded private key for service account token generation.
|
||||||
|
serviceAccount:
|
||||||
|
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
# API server specific configuration options.
|
||||||
|
apiServer:
|
||||||
|
image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
# Configure the API server admission plugins.
|
||||||
|
admissionControl:
|
||||||
|
- name: PodSecurity # Name is the name of the admission controller.
|
||||||
|
# Configuration is an embedded configuration object to be used as the plugin's
|
||||||
|
configuration:
|
||||||
|
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||||
|
defaults:
|
||||||
|
audit: restricted
|
||||||
|
audit-version: latest
|
||||||
|
enforce: baseline
|
||||||
|
enforce-version: latest
|
||||||
|
warn: restricted
|
||||||
|
warn-version: latest
|
||||||
|
exemptions:
|
||||||
|
namespaces:
|
||||||
|
- kube-system
|
||||||
|
runtimeClasses: []
|
||||||
|
usernames: []
|
||||||
|
kind: PodSecurityConfiguration
|
||||||
|
# Configure the API server audit policy.
|
||||||
|
auditPolicy:
|
||||||
|
apiVersion: audit.k8s.io/v1
|
||||||
|
kind: Policy
|
||||||
|
rules:
|
||||||
|
- level: Metadata
|
||||||
|
|
||||||
|
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||||
|
# authorizationConfig:
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: webhook # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: Deny
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# matchConditions:
|
||||||
|
# - expression: has(request.resourceAttributes)
|
||||||
|
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: NoOpinion
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# Controller manager server specific configuration options.
|
||||||
|
controllerManager:
|
||||||
|
image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
||||||
|
# Kube-proxy server-specific configuration options
|
||||||
|
proxy:
|
||||||
|
image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
||||||
|
|
||||||
|
# # Disable kube-proxy deployment on cluster bootstrap.
|
||||||
|
# disabled: false
|
||||||
|
# Scheduler server specific configuration options.
|
||||||
|
scheduler:
|
||||||
|
image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
||||||
|
# Configures cluster member discovery.
|
||||||
|
discovery:
|
||||||
|
enabled: true # Enable the cluster membership discovery feature.
|
||||||
|
# Configure registries used for cluster member discovery.
|
||||||
|
registries:
|
||||||
|
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||||
|
kubernetes:
|
||||||
|
disabled: true # Disable Kubernetes discovery registry.
|
||||||
|
# Service registry is using an external service to push and pull information about cluster members.
|
||||||
|
service: {}
|
||||||
|
# # External service endpoint.
|
||||||
|
# endpoint: https://discovery.talos.dev/
|
||||||
|
# Etcd specific configuration options.
|
||||||
|
etcd:
|
||||||
|
# The `ca` is the root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
|
||||||
|
# # The container image used to create the etcd service.
|
||||||
|
# image: registry.k8s.io/etcd:v3.6.7
|
||||||
|
|
||||||
|
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||||
|
# advertisedSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# A list of urls that point to additional manifests.
|
||||||
|
extraManifests: []
|
||||||
|
# - https://www.example.com/manifest1.yaml
|
||||||
|
# - https://www.example.com/manifest2.yaml
|
||||||
|
|
||||||
|
# A list of inline Kubernetes manifests.
|
||||||
|
inlineManifests: []
|
||||||
|
# - name: namespace-ci # Name of the manifest.
|
||||||
|
# contents: |- # Manifest contents as a string.
|
||||||
|
# apiVersion: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# metadata:
|
||||||
|
# name: ci
|
||||||
|
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # Core DNS specific configuration options.
|
||||||
|
# coreDNS:
|
||||||
|
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
||||||
|
|
||||||
|
# # External cloud provider configuration.
|
||||||
|
# externalCloudProvider:
|
||||||
|
# enabled: true # Enable external cloud provider.
|
||||||
|
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||||
|
# manifests:
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||||
|
|
||||||
|
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||||
|
# extraManifestHeaders:
|
||||||
|
# Token: "1234567"
|
||||||
|
# X-ExtraInfo: info
|
||||||
|
|
||||||
|
# # Settings for admin kubeconfig generation.
|
||||||
|
# adminKubeconfig:
|
||||||
|
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||||
|
|
||||||
|
# # Allows running workload on control-plane nodes.
|
||||||
|
# allowSchedulingOnControlPlanes: true
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
hostname: talos-cp2
|
||||||
|
# hostname: controlplane1.example.org
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: ExtensionServiceConfig
|
||||||
|
name: tailscale # Name of the extension service.
|
||||||
|
# The environment for the extension service.
|
||||||
|
environment:
|
||||||
|
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||||
407
talos/configs/talos-cp3.yaml
Normal file
407
talos/configs/talos-cp3.yaml
Normal file
|
|
@ -0,0 +1,407 @@
|
||||||
|
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||||
|
debug: false # Enable verbose logging to the console.
|
||||||
|
persist: true
|
||||||
|
# Provides machine specific configuration options.
|
||||||
|
machine:
|
||||||
|
type: controlplane # Defines the role of the machine within the cluster.
|
||||||
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
|
# The root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
|
certSANs: []
|
||||||
|
# # Uncomment this to enable SANs.
|
||||||
|
# - 10.0.0.10
|
||||||
|
# - 172.16.0.10
|
||||||
|
# - 192.168.0.10
|
||||||
|
|
||||||
|
# Used to provide additional options to the kubelet.
|
||||||
|
kubelet:
|
||||||
|
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||||
|
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||||
|
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||||
|
|
||||||
|
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||||
|
# clusterDNS:
|
||||||
|
# - 10.96.0.10
|
||||||
|
# - 169.254.2.53
|
||||||
|
|
||||||
|
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||||
|
# extraArgs:
|
||||||
|
# key: value
|
||||||
|
|
||||||
|
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||||
|
# extraMounts:
|
||||||
|
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||||
|
# type: bind # Type specifies the mount kind.
|
||||||
|
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||||
|
# # Options are fstab style mount options.
|
||||||
|
# options:
|
||||||
|
# - bind
|
||||||
|
# - rshared
|
||||||
|
# - rw
|
||||||
|
|
||||||
|
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||||
|
# extraConfig:
|
||||||
|
# serverTLSBootstrap: true
|
||||||
|
|
||||||
|
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||||
|
# credentialProviderConfig:
|
||||||
|
# apiVersion: kubelet.config.k8s.io/v1
|
||||||
|
# kind: CredentialProviderConfig
|
||||||
|
# providers:
|
||||||
|
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||||
|
# defaultCacheDuration: 12h
|
||||||
|
# matchImages:
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||||
|
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||||
|
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||||
|
# name: ecr-credential-provider
|
||||||
|
|
||||||
|
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||||
|
# nodeIP:
|
||||||
|
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||||
|
# validSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - '!10.0.0.3/32'
|
||||||
|
# - fdc7::/16
|
||||||
|
# Provides machine specific network configuration options.
|
||||||
|
network:
|
||||||
|
|
||||||
|
# # Configures KubeSpan feature.
|
||||||
|
# kubespan:
|
||||||
|
# enabled: true # Enable the KubeSpan feature.
|
||||||
|
# Used to provide instructions for installations.
|
||||||
|
install:
|
||||||
|
disk: /dev/sda # The disk used for installations.
|
||||||
|
image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation.
|
||||||
|
extensions:
|
||||||
|
- image: ghcr.io/siderolabs/tailscale:1.82.1
|
||||||
|
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||||
|
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||||
|
extraKernelArgs:
|
||||||
|
- console=tty0
|
||||||
|
|
||||||
|
# # Look up disk using disk attributes like model, size, serial and others.
|
||||||
|
# diskSelector:
|
||||||
|
# size: 4GB # Disk size.
|
||||||
|
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||||
|
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||||
|
# Features describe individual Talos features that can be switched on or off.
|
||||||
|
features:
|
||||||
|
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||||
|
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||||
|
kubePrism:
|
||||||
|
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||||
|
port: 7445 # KubePrism port.
|
||||||
|
# Configures host DNS caching resolver.
|
||||||
|
hostDNS:
|
||||||
|
enabled: true # Enable host DNS caching resolver.
|
||||||
|
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||||
|
|
||||||
|
# # Configure Talos API access from Kubernetes pods.
|
||||||
|
# kubernetesTalosAPIAccess:
|
||||||
|
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||||
|
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||||
|
# allowedRoles:
|
||||||
|
# - os:reader
|
||||||
|
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||||
|
# allowedKubernetesNamespaces:
|
||||||
|
# - kube-system
|
||||||
|
# Configures the node labels for the machine.
|
||||||
|
nodeLabels:
|
||||||
|
node.kubernetes.io/exclude-from-external-load-balancers: ""
|
||||||
|
|
||||||
|
# # Provides machine specific control plane configuration options.
|
||||||
|
|
||||||
|
# # ControlPlane definition example.
|
||||||
|
# controlPlane:
|
||||||
|
# # Controller manager machine specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# disabled: false # Disable kube-controller-manager on the node.
|
||||||
|
# # Scheduler machine specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# disabled: true # Disable kube-scheduler on the node.
|
||||||
|
|
||||||
|
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||||
|
|
||||||
|
# # nginx static pod.
|
||||||
|
# pods:
|
||||||
|
# - apiVersion: v1
|
||||||
|
# kind: pod
|
||||||
|
# metadata:
|
||||||
|
# name: nginx
|
||||||
|
# spec:
|
||||||
|
# containers:
|
||||||
|
# - image: nginx
|
||||||
|
# name: nginx
|
||||||
|
|
||||||
|
# # Allows the addition of user specified files.
|
||||||
|
|
||||||
|
# # MachineFiles usage example.
|
||||||
|
# files:
|
||||||
|
# - content: '...' # The contents of the file.
|
||||||
|
# permissions: 0o666 # The file's permissions in octal.
|
||||||
|
# path: /tmp/file.txt # The path of the file.
|
||||||
|
# op: append # The operation to use
|
||||||
|
|
||||||
|
# # The `env` field allows for the addition of environment variables.
|
||||||
|
|
||||||
|
# # Environment variables definition examples.
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||||
|
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||||
|
# https_proxy: http://SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||||
|
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysctls.
|
||||||
|
|
||||||
|
# # MachineSysctls usage example.
|
||||||
|
# sysctls:
|
||||||
|
# kernel.domainname: talos.dev
|
||||||
|
# net.ipv4.ip_forward: "0"
|
||||||
|
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysfs.
|
||||||
|
|
||||||
|
# # MachineSysfs usage example.
|
||||||
|
# sysfs:
|
||||||
|
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||||
|
|
||||||
|
# # Configures the udev system.
|
||||||
|
# udev:
|
||||||
|
# # List of udev rules to apply to the udev system
|
||||||
|
# rules:
|
||||||
|
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||||
|
|
||||||
|
# # Configures the logging system.
|
||||||
|
# logging:
|
||||||
|
# # Logging destination.
|
||||||
|
# destinations:
|
||||||
|
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||||
|
# format: json_lines # Logs format.
|
||||||
|
|
||||||
|
# # Configures the kernel.
|
||||||
|
# kernel:
|
||||||
|
# # Kernel modules to load.
|
||||||
|
# modules:
|
||||||
|
# - name: btrfs # Module name.
|
||||||
|
|
||||||
|
# # Configures the seccomp profiles for the machine.
|
||||||
|
# seccompProfiles:
|
||||||
|
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||||
|
# # The `value` field is used to provide the seccomp profile.
|
||||||
|
# value:
|
||||||
|
# defaultAction: SCMP_ACT_LOG
|
||||||
|
|
||||||
|
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||||
|
|
||||||
|
# # override default open file limit
|
||||||
|
# baseRuntimeSpecOverrides:
|
||||||
|
# process:
|
||||||
|
# rlimits:
|
||||||
|
# - hard: 1024
|
||||||
|
# soft: 1024
|
||||||
|
# type: RLIMIT_NOFILE
|
||||||
|
|
||||||
|
# # Configures the node annotations for the machine.
|
||||||
|
|
||||||
|
# # node annotations example.
|
||||||
|
# nodeAnnotations:
|
||||||
|
# customer.io/rack: r13a25
|
||||||
|
|
||||||
|
# # Configures the node taints for the machine. Effect is optional.
|
||||||
|
|
||||||
|
# # node taints example.
|
||||||
|
# nodeTaints:
|
||||||
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
|
# Provides cluster specific configuration options.
|
||||||
|
cluster:
|
||||||
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
|
# Provides control plane specific configuration options.
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
clusterName: home-cluster # Configures the cluster's name.
|
||||||
|
# Provides cluster specific network configuration options.
|
||||||
|
network:
|
||||||
|
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||||
|
# The pod subnet CIDR.
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
# The service subnet CIDR.
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
|
||||||
|
# # The CNI used.
|
||||||
|
# cni:
|
||||||
|
# name: custom # Name of CNI to use.
|
||||||
|
# # URLs containing manifests to apply for the CNI.
|
||||||
|
# urls:
|
||||||
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
|
secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
|
aggregatorCA:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
# The base64 encoded private key for service account token generation.
|
||||||
|
serviceAccount:
|
||||||
|
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
# API server specific configuration options.
|
||||||
|
apiServer:
|
||||||
|
image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
# Configure the API server admission plugins.
|
||||||
|
admissionControl:
|
||||||
|
- name: PodSecurity # Name is the name of the admission controller.
|
||||||
|
# Configuration is an embedded configuration object to be used as the plugin's
|
||||||
|
configuration:
|
||||||
|
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||||
|
defaults:
|
||||||
|
audit: restricted
|
||||||
|
audit-version: latest
|
||||||
|
enforce: baseline
|
||||||
|
enforce-version: latest
|
||||||
|
warn: restricted
|
||||||
|
warn-version: latest
|
||||||
|
exemptions:
|
||||||
|
namespaces:
|
||||||
|
- kube-system
|
||||||
|
runtimeClasses: []
|
||||||
|
usernames: []
|
||||||
|
kind: PodSecurityConfiguration
|
||||||
|
# Configure the API server audit policy.
|
||||||
|
auditPolicy:
|
||||||
|
apiVersion: audit.k8s.io/v1
|
||||||
|
kind: Policy
|
||||||
|
rules:
|
||||||
|
- level: Metadata
|
||||||
|
|
||||||
|
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||||
|
# authorizationConfig:
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: webhook # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: Deny
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# matchConditions:
|
||||||
|
# - expression: has(request.resourceAttributes)
|
||||||
|
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: NoOpinion
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# Controller manager server specific configuration options.
|
||||||
|
controllerManager:
|
||||||
|
image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
||||||
|
# Kube-proxy server-specific configuration options
|
||||||
|
proxy:
|
||||||
|
image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
||||||
|
|
||||||
|
# # Disable kube-proxy deployment on cluster bootstrap.
|
||||||
|
# disabled: false
|
||||||
|
# Scheduler server specific configuration options.
|
||||||
|
scheduler:
|
||||||
|
image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
||||||
|
# Configures cluster member discovery.
|
||||||
|
discovery:
|
||||||
|
enabled: true # Enable the cluster membership discovery feature.
|
||||||
|
# Configure registries used for cluster member discovery.
|
||||||
|
registries:
|
||||||
|
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||||
|
kubernetes:
|
||||||
|
disabled: true # Disable Kubernetes discovery registry.
|
||||||
|
# Service registry is using an external service to push and pull information about cluster members.
|
||||||
|
service: {}
|
||||||
|
# # External service endpoint.
|
||||||
|
# endpoint: https://discovery.talos.dev/
|
||||||
|
# Etcd specific configuration options.
|
||||||
|
etcd:
|
||||||
|
# The `ca` is the root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
|
||||||
|
# # The container image used to create the etcd service.
|
||||||
|
# image: registry.k8s.io/etcd:v3.6.7
|
||||||
|
|
||||||
|
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||||
|
# advertisedSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# A list of urls that point to additional manifests.
|
||||||
|
extraManifests: []
|
||||||
|
# - https://www.example.com/manifest1.yaml
|
||||||
|
# - https://www.example.com/manifest2.yaml
|
||||||
|
|
||||||
|
# A list of inline Kubernetes manifests.
|
||||||
|
inlineManifests: []
|
||||||
|
# - name: namespace-ci # Name of the manifest.
|
||||||
|
# contents: |- # Manifest contents as a string.
|
||||||
|
# apiVersion: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# metadata:
|
||||||
|
# name: ci
|
||||||
|
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # Core DNS specific configuration options.
|
||||||
|
# coreDNS:
|
||||||
|
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
||||||
|
|
||||||
|
# # External cloud provider configuration.
|
||||||
|
# externalCloudProvider:
|
||||||
|
# enabled: true # Enable external cloud provider.
|
||||||
|
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||||
|
# manifests:
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||||
|
|
||||||
|
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||||
|
# extraManifestHeaders:
|
||||||
|
# Token: "1234567"
|
||||||
|
# X-ExtraInfo: info
|
||||||
|
|
||||||
|
# # Settings for admin kubeconfig generation.
|
||||||
|
# adminKubeconfig:
|
||||||
|
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||||
|
|
||||||
|
# # Allows running workload on control-plane nodes.
|
||||||
|
# allowSchedulingOnControlPlanes: true
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
hostname: talos-cp3
|
||||||
|
# hostname: controlplane1.example.org
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: ExtensionServiceConfig
|
||||||
|
name: tailscale # Name of the extension service.
|
||||||
|
# The environment for the extension service.
|
||||||
|
environment:
|
||||||
|
- TS_AUTHKEY=tskey-auth-kwat3eR2p711CNTRL-K3m1PTL9hJHuqFJ5v5aDJHW2b8qsScQkF
|
||||||
432
talos/configs/talos-worker1.yaml
Normal file
432
talos/configs/talos-worker1.yaml
Normal file
|
|
@ -0,0 +1,432 @@
|
||||||
|
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||||
|
debug: false # Enable verbose logging to the console.
|
||||||
|
persist: true
|
||||||
|
# Provides machine specific configuration options.
|
||||||
|
machine:
|
||||||
|
type: worker # Defines the role of the machine within the cluster.
|
||||||
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
|
# The root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: ""
|
||||||
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
|
certSANs: []
|
||||||
|
# # Uncomment this to enable SANs.
|
||||||
|
# - 10.0.0.10
|
||||||
|
# - 172.16.0.10
|
||||||
|
# - 192.168.0.10
|
||||||
|
|
||||||
|
# Used to provide additional options to the kubelet.
|
||||||
|
kubelet:
|
||||||
|
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||||
|
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||||
|
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||||
|
|
||||||
|
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||||
|
# clusterDNS:
|
||||||
|
# - 10.96.0.10
|
||||||
|
# - 169.254.2.53
|
||||||
|
|
||||||
|
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||||
|
# extraArgs:
|
||||||
|
# key: value
|
||||||
|
|
||||||
|
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||||
|
# extraMounts:
|
||||||
|
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||||
|
# type: bind # Type specifies the mount kind.
|
||||||
|
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||||
|
# # Options are fstab style mount options.
|
||||||
|
# options:
|
||||||
|
# - bind
|
||||||
|
# - rshared
|
||||||
|
# - rw
|
||||||
|
|
||||||
|
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||||
|
# extraConfig:
|
||||||
|
# serverTLSBootstrap: true
|
||||||
|
|
||||||
|
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||||
|
# credentialProviderConfig:
|
||||||
|
# apiVersion: kubelet.config.k8s.io/v1
|
||||||
|
# kind: CredentialProviderConfig
|
||||||
|
# providers:
|
||||||
|
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||||
|
# defaultCacheDuration: 12h
|
||||||
|
# matchImages:
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||||
|
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||||
|
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||||
|
# name: ecr-credential-provider
|
||||||
|
|
||||||
|
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||||
|
# nodeIP:
|
||||||
|
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||||
|
# validSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - '!10.0.0.3/32'
|
||||||
|
# - fdc7::/16
|
||||||
|
# Provides machine specific network configuration options.
|
||||||
|
network:
|
||||||
|
|
||||||
|
# # Configures KubeSpan feature.
|
||||||
|
# kubespan:
|
||||||
|
# enabled: true # Enable the KubeSpan feature.
|
||||||
|
# Used to provide instructions for installations.
|
||||||
|
install:
|
||||||
|
disk: /dev/sda # The disk used for installations.
|
||||||
|
image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation.
|
||||||
|
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||||
|
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||||
|
extraKernelArgs:
|
||||||
|
- console=tty0
|
||||||
|
|
||||||
|
# # Look up disk using disk attributes like model, size, serial and others.
|
||||||
|
# diskSelector:
|
||||||
|
# size: 4GB # Disk size.
|
||||||
|
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||||
|
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||||
|
registries: {}
|
||||||
|
# Features describe individual Talos features that can be switched on or off.
|
||||||
|
features:
|
||||||
|
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||||
|
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||||
|
kubePrism:
|
||||||
|
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||||
|
port: 7445 # KubePrism port.
|
||||||
|
# Configures host DNS caching resolver.
|
||||||
|
hostDNS:
|
||||||
|
enabled: true # Enable host DNS caching resolver.
|
||||||
|
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||||
|
|
||||||
|
# # Configure Talos API access from Kubernetes pods.
|
||||||
|
# kubernetesTalosAPIAccess:
|
||||||
|
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||||
|
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||||
|
# allowedRoles:
|
||||||
|
# - os:reader
|
||||||
|
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||||
|
# allowedKubernetesNamespaces:
|
||||||
|
# - kube-system
|
||||||
|
|
||||||
|
# # Provides machine specific control plane configuration options.
|
||||||
|
|
||||||
|
# # ControlPlane definition example.
|
||||||
|
# controlPlane:
|
||||||
|
# # Controller manager machine specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# disabled: false # Disable kube-controller-manager on the node.
|
||||||
|
# # Scheduler machine specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# disabled: true # Disable kube-scheduler on the node.
|
||||||
|
|
||||||
|
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||||
|
|
||||||
|
# # nginx static pod.
|
||||||
|
# pods:
|
||||||
|
# - apiVersion: v1
|
||||||
|
# kind: pod
|
||||||
|
# metadata:
|
||||||
|
# name: nginx
|
||||||
|
# spec:
|
||||||
|
# containers:
|
||||||
|
# - image: nginx
|
||||||
|
# name: nginx
|
||||||
|
|
||||||
|
# # Allows the addition of user specified files.
|
||||||
|
|
||||||
|
# # MachineFiles usage example.
|
||||||
|
# files:
|
||||||
|
# - content: '...' # The contents of the file.
|
||||||
|
# permissions: 0o666 # The file's permissions in octal.
|
||||||
|
# path: /tmp/file.txt # The path of the file.
|
||||||
|
# op: append # The operation to use
|
||||||
|
|
||||||
|
# # The `env` field allows for the addition of environment variables.
|
||||||
|
|
||||||
|
# # Environment variables definition examples.
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||||
|
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||||
|
# https_proxy: http://SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||||
|
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysctls.
|
||||||
|
|
||||||
|
# # MachineSysctls usage example.
|
||||||
|
# sysctls:
|
||||||
|
# kernel.domainname: talos.dev
|
||||||
|
# net.ipv4.ip_forward: "0"
|
||||||
|
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysfs.
|
||||||
|
|
||||||
|
# # MachineSysfs usage example.
|
||||||
|
# sysfs:
|
||||||
|
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||||
|
|
||||||
|
# # Configures the udev system.
|
||||||
|
# udev:
|
||||||
|
# # List of udev rules to apply to the udev system
|
||||||
|
# rules:
|
||||||
|
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||||
|
|
||||||
|
# # Configures the logging system.
|
||||||
|
# logging:
|
||||||
|
# # Logging destination.
|
||||||
|
# destinations:
|
||||||
|
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||||
|
# format: json_lines # Logs format.
|
||||||
|
|
||||||
|
# # Configures the kernel.
|
||||||
|
# kernel:
|
||||||
|
# # Kernel modules to load.
|
||||||
|
# modules:
|
||||||
|
# - name: btrfs # Module name.
|
||||||
|
|
||||||
|
# # Configures the seccomp profiles for the machine.
|
||||||
|
# seccompProfiles:
|
||||||
|
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||||
|
# # The `value` field is used to provide the seccomp profile.
|
||||||
|
# value:
|
||||||
|
# defaultAction: SCMP_ACT_LOG
|
||||||
|
|
||||||
|
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||||
|
|
||||||
|
# # override default open file limit
|
||||||
|
# baseRuntimeSpecOverrides:
|
||||||
|
# process:
|
||||||
|
# rlimits:
|
||||||
|
# - hard: 1024
|
||||||
|
# soft: 1024
|
||||||
|
# type: RLIMIT_NOFILE
|
||||||
|
|
||||||
|
# # Configures the node labels for the machine.
|
||||||
|
|
||||||
|
# # node labels example.
|
||||||
|
# nodeLabels:
|
||||||
|
# exampleLabel: exampleLabelValue
|
||||||
|
|
||||||
|
# # Configures the node annotations for the machine.
|
||||||
|
|
||||||
|
# # node annotations example.
|
||||||
|
# nodeAnnotations:
|
||||||
|
# customer.io/rack: r13a25
|
||||||
|
|
||||||
|
# # Configures the node taints for the machine. Effect is optional.
|
||||||
|
|
||||||
|
# # node taints example.
|
||||||
|
# nodeTaints:
|
||||||
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
|
# Provides cluster specific configuration options.
|
||||||
|
cluster:
|
||||||
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
|
# Provides control plane specific configuration options.
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
clusterName: home-cluster # Configures the cluster's name.
|
||||||
|
# Provides cluster specific network configuration options.
|
||||||
|
network:
|
||||||
|
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||||
|
# The pod subnet CIDR.
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
# The service subnet CIDR.
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
|
||||||
|
# # The CNI used.
|
||||||
|
# cni:
|
||||||
|
# name: custom # Name of CNI to use.
|
||||||
|
# # URLs containing manifests to apply for the CNI.
|
||||||
|
# urls:
|
||||||
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: ""
|
||||||
|
# Configures cluster member discovery.
|
||||||
|
discovery:
|
||||||
|
enabled: true # Enable the cluster membership discovery feature.
|
||||||
|
# Configure registries used for cluster member discovery.
|
||||||
|
registries:
|
||||||
|
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||||
|
kubernetes:
|
||||||
|
disabled: true # Disable Kubernetes discovery registry.
|
||||||
|
# Service registry is using an external service to push and pull information about cluster members.
|
||||||
|
service: {}
|
||||||
|
# # External service endpoint.
|
||||||
|
# endpoint: https://discovery.talos.dev/
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
|
|
||||||
|
# # AggregatorCA example.
|
||||||
|
# aggregatorCA:
|
||||||
|
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
|
||||||
|
# # The base64 encoded private key for service account token generation.
|
||||||
|
|
||||||
|
# # AggregatorCA example.
|
||||||
|
# serviceAccount:
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
|
||||||
|
# # API server specific configuration options.
|
||||||
|
# apiServer:
|
||||||
|
# image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
# # Extra arguments to supply to the API server.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: ServerSideApply=true
|
||||||
|
# http2-max-streams-per-connection: "32"
|
||||||
|
# # Extra certificate subject alternative names for the API server's certificate.
|
||||||
|
# certSANs:
|
||||||
|
# - 1.2.3.4
|
||||||
|
# - 4.5.6.7
|
||||||
|
# # Configure the API server admission plugins.
|
||||||
|
# admissionControl:
|
||||||
|
# - name: PodSecurity # Name is the name of the admission controller.
|
||||||
|
# # Configuration is an embedded configuration object to be used as the plugin's
|
||||||
|
# configuration:
|
||||||
|
# apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||||
|
# defaults:
|
||||||
|
# audit: restricted
|
||||||
|
# audit-version: latest
|
||||||
|
# enforce: baseline
|
||||||
|
# enforce-version: latest
|
||||||
|
# warn: restricted
|
||||||
|
# warn-version: latest
|
||||||
|
# exemptions:
|
||||||
|
# namespaces:
|
||||||
|
# - kube-system
|
||||||
|
# runtimeClasses: []
|
||||||
|
# usernames: []
|
||||||
|
# kind: PodSecurityConfiguration
|
||||||
|
# # Configure the API server audit policy.
|
||||||
|
# auditPolicy:
|
||||||
|
# apiVersion: audit.k8s.io/v1
|
||||||
|
# kind: Policy
|
||||||
|
# rules:
|
||||||
|
# - level: Metadata
|
||||||
|
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||||
|
# authorizationConfig:
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: webhook # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: Deny
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# matchConditions:
|
||||||
|
# - expression: has(request.resourceAttributes)
|
||||||
|
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: NoOpinion
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
|
||||||
|
# # Controller manager server specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
||||||
|
# # Extra arguments to supply to the controller manager.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: ServerSideApply=true
|
||||||
|
|
||||||
|
# # Kube-proxy server-specific configuration options
|
||||||
|
# proxy:
|
||||||
|
# disabled: false # Disable kube-proxy deployment on cluster bootstrap.
|
||||||
|
# image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
||||||
|
# mode: ipvs # proxy mode of kube-proxy.
|
||||||
|
# # Extra arguments to supply to kube-proxy.
|
||||||
|
# extraArgs:
|
||||||
|
# proxy-mode: iptables
|
||||||
|
|
||||||
|
# # Scheduler server specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
||||||
|
# # Extra arguments to supply to the scheduler.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: AllBeta=true
|
||||||
|
|
||||||
|
# # Etcd specific configuration options.
|
||||||
|
# etcd:
|
||||||
|
# image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service.
|
||||||
|
# # The `ca` is the root certificate authority of the PKI.
|
||||||
|
# ca:
|
||||||
|
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
# # Extra arguments to supply to etcd.
|
||||||
|
# extraArgs:
|
||||||
|
# election-timeout: "5000"
|
||||||
|
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||||
|
# advertisedSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
|
||||||
|
# # Core DNS specific configuration options.
|
||||||
|
# coreDNS:
|
||||||
|
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
||||||
|
|
||||||
|
# # External cloud provider configuration.
|
||||||
|
# externalCloudProvider:
|
||||||
|
# enabled: true # Enable external cloud provider.
|
||||||
|
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||||
|
# manifests:
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||||
|
|
||||||
|
# # A list of urls that point to additional manifests.
|
||||||
|
# extraManifests:
|
||||||
|
# - https://www.example.com/manifest1.yaml
|
||||||
|
# - https://www.example.com/manifest2.yaml
|
||||||
|
|
||||||
|
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||||
|
# extraManifestHeaders:
|
||||||
|
# Token: "1234567"
|
||||||
|
# X-ExtraInfo: info
|
||||||
|
|
||||||
|
# # A list of inline Kubernetes manifests.
|
||||||
|
# inlineManifests:
|
||||||
|
# - name: namespace-ci # Name of the manifest.
|
||||||
|
# contents: |- # Manifest contents as a string.
|
||||||
|
# apiVersion: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# metadata:
|
||||||
|
# name: ci
|
||||||
|
|
||||||
|
# # Settings for admin kubeconfig generation.
|
||||||
|
# adminKubeconfig:
|
||||||
|
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||||
|
|
||||||
|
# # Allows running workload on control-plane nodes.
|
||||||
|
# allowSchedulingOnControlPlanes: true
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
hostname: talos-worker1
|
||||||
|
# hostname: controlplane1.example.org
|
||||||
432
talos/configs/talos-worker2.yaml
Normal file
432
talos/configs/talos-worker2.yaml
Normal file
|
|
@ -0,0 +1,432 @@
|
||||||
|
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||||
|
debug: false # Enable verbose logging to the console.
|
||||||
|
persist: true
|
||||||
|
# Provides machine specific configuration options.
|
||||||
|
machine:
|
||||||
|
type: worker # Defines the role of the machine within the cluster.
|
||||||
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
|
# The root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: ""
|
||||||
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
|
certSANs: []
|
||||||
|
# # Uncomment this to enable SANs.
|
||||||
|
# - 10.0.0.10
|
||||||
|
# - 172.16.0.10
|
||||||
|
# - 192.168.0.10
|
||||||
|
|
||||||
|
# Used to provide additional options to the kubelet.
|
||||||
|
kubelet:
|
||||||
|
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||||
|
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||||
|
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||||
|
|
||||||
|
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||||
|
# clusterDNS:
|
||||||
|
# - 10.96.0.10
|
||||||
|
# - 169.254.2.53
|
||||||
|
|
||||||
|
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||||
|
# extraArgs:
|
||||||
|
# key: value
|
||||||
|
|
||||||
|
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||||
|
# extraMounts:
|
||||||
|
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||||
|
# type: bind # Type specifies the mount kind.
|
||||||
|
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||||
|
# # Options are fstab style mount options.
|
||||||
|
# options:
|
||||||
|
# - bind
|
||||||
|
# - rshared
|
||||||
|
# - rw
|
||||||
|
|
||||||
|
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||||
|
# extraConfig:
|
||||||
|
# serverTLSBootstrap: true
|
||||||
|
|
||||||
|
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||||
|
# credentialProviderConfig:
|
||||||
|
# apiVersion: kubelet.config.k8s.io/v1
|
||||||
|
# kind: CredentialProviderConfig
|
||||||
|
# providers:
|
||||||
|
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||||
|
# defaultCacheDuration: 12h
|
||||||
|
# matchImages:
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||||
|
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||||
|
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||||
|
# name: ecr-credential-provider
|
||||||
|
|
||||||
|
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||||
|
# nodeIP:
|
||||||
|
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||||
|
# validSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - '!10.0.0.3/32'
|
||||||
|
# - fdc7::/16
|
||||||
|
# Provides machine specific network configuration options.
|
||||||
|
network:
|
||||||
|
|
||||||
|
# # Configures KubeSpan feature.
|
||||||
|
# kubespan:
|
||||||
|
# enabled: true # Enable the KubeSpan feature.
|
||||||
|
# Used to provide instructions for installations.
|
||||||
|
install:
|
||||||
|
disk: /dev/sda # The disk used for installations.
|
||||||
|
image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation.
|
||||||
|
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||||
|
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||||
|
extraKernelArgs:
|
||||||
|
- console=tty0
|
||||||
|
|
||||||
|
# # Look up disk using disk attributes like model, size, serial and others.
|
||||||
|
# diskSelector:
|
||||||
|
# size: 4GB # Disk size.
|
||||||
|
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||||
|
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||||
|
registries: {}
|
||||||
|
# Features describe individual Talos features that can be switched on or off.
|
||||||
|
features:
|
||||||
|
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||||
|
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||||
|
kubePrism:
|
||||||
|
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||||
|
port: 7445 # KubePrism port.
|
||||||
|
# Configures host DNS caching resolver.
|
||||||
|
hostDNS:
|
||||||
|
enabled: true # Enable host DNS caching resolver.
|
||||||
|
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||||
|
|
||||||
|
# # Configure Talos API access from Kubernetes pods.
|
||||||
|
# kubernetesTalosAPIAccess:
|
||||||
|
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||||
|
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||||
|
# allowedRoles:
|
||||||
|
# - os:reader
|
||||||
|
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||||
|
# allowedKubernetesNamespaces:
|
||||||
|
# - kube-system
|
||||||
|
|
||||||
|
# # Provides machine specific control plane configuration options.
|
||||||
|
|
||||||
|
# # ControlPlane definition example.
|
||||||
|
# controlPlane:
|
||||||
|
# # Controller manager machine specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# disabled: false # Disable kube-controller-manager on the node.
|
||||||
|
# # Scheduler machine specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# disabled: true # Disable kube-scheduler on the node.
|
||||||
|
|
||||||
|
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||||
|
|
||||||
|
# # nginx static pod.
|
||||||
|
# pods:
|
||||||
|
# - apiVersion: v1
|
||||||
|
# kind: pod
|
||||||
|
# metadata:
|
||||||
|
# name: nginx
|
||||||
|
# spec:
|
||||||
|
# containers:
|
||||||
|
# - image: nginx
|
||||||
|
# name: nginx
|
||||||
|
|
||||||
|
# # Allows the addition of user specified files.
|
||||||
|
|
||||||
|
# # MachineFiles usage example.
|
||||||
|
# files:
|
||||||
|
# - content: '...' # The contents of the file.
|
||||||
|
# permissions: 0o666 # The file's permissions in octal.
|
||||||
|
# path: /tmp/file.txt # The path of the file.
|
||||||
|
# op: append # The operation to use
|
||||||
|
|
||||||
|
# # The `env` field allows for the addition of environment variables.
|
||||||
|
|
||||||
|
# # Environment variables definition examples.
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||||
|
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||||
|
# https_proxy: http://SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||||
|
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysctls.
|
||||||
|
|
||||||
|
# # MachineSysctls usage example.
|
||||||
|
# sysctls:
|
||||||
|
# kernel.domainname: talos.dev
|
||||||
|
# net.ipv4.ip_forward: "0"
|
||||||
|
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysfs.
|
||||||
|
|
||||||
|
# # MachineSysfs usage example.
|
||||||
|
# sysfs:
|
||||||
|
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||||
|
|
||||||
|
# # Configures the udev system.
|
||||||
|
# udev:
|
||||||
|
# # List of udev rules to apply to the udev system
|
||||||
|
# rules:
|
||||||
|
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||||
|
|
||||||
|
# # Configures the logging system.
|
||||||
|
# logging:
|
||||||
|
# # Logging destination.
|
||||||
|
# destinations:
|
||||||
|
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||||
|
# format: json_lines # Logs format.
|
||||||
|
|
||||||
|
# # Configures the kernel.
|
||||||
|
# kernel:
|
||||||
|
# # Kernel modules to load.
|
||||||
|
# modules:
|
||||||
|
# - name: btrfs # Module name.
|
||||||
|
|
||||||
|
# # Configures the seccomp profiles for the machine.
|
||||||
|
# seccompProfiles:
|
||||||
|
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||||
|
# # The `value` field is used to provide the seccomp profile.
|
||||||
|
# value:
|
||||||
|
# defaultAction: SCMP_ACT_LOG
|
||||||
|
|
||||||
|
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||||
|
|
||||||
|
# # override default open file limit
|
||||||
|
# baseRuntimeSpecOverrides:
|
||||||
|
# process:
|
||||||
|
# rlimits:
|
||||||
|
# - hard: 1024
|
||||||
|
# soft: 1024
|
||||||
|
# type: RLIMIT_NOFILE
|
||||||
|
|
||||||
|
# # Configures the node labels for the machine.
|
||||||
|
|
||||||
|
# # node labels example.
|
||||||
|
# nodeLabels:
|
||||||
|
# exampleLabel: exampleLabelValue
|
||||||
|
|
||||||
|
# # Configures the node annotations for the machine.
|
||||||
|
|
||||||
|
# # node annotations example.
|
||||||
|
# nodeAnnotations:
|
||||||
|
# customer.io/rack: r13a25
|
||||||
|
|
||||||
|
# # Configures the node taints for the machine. Effect is optional.
|
||||||
|
|
||||||
|
# # node taints example.
|
||||||
|
# nodeTaints:
|
||||||
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
|
# Provides cluster specific configuration options.
|
||||||
|
cluster:
|
||||||
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
|
# Provides control plane specific configuration options.
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
clusterName: home-cluster # Configures the cluster's name.
|
||||||
|
# Provides cluster specific network configuration options.
|
||||||
|
network:
|
||||||
|
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||||
|
# The pod subnet CIDR.
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
# The service subnet CIDR.
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
|
||||||
|
# # The CNI used.
|
||||||
|
# cni:
|
||||||
|
# name: custom # Name of CNI to use.
|
||||||
|
# # URLs containing manifests to apply for the CNI.
|
||||||
|
# urls:
|
||||||
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: ""
|
||||||
|
# Configures cluster member discovery.
|
||||||
|
discovery:
|
||||||
|
enabled: true # Enable the cluster membership discovery feature.
|
||||||
|
# Configure registries used for cluster member discovery.
|
||||||
|
registries:
|
||||||
|
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||||
|
kubernetes:
|
||||||
|
disabled: true # Disable Kubernetes discovery registry.
|
||||||
|
# Service registry is using an external service to push and pull information about cluster members.
|
||||||
|
service: {}
|
||||||
|
# # External service endpoint.
|
||||||
|
# endpoint: https://discovery.talos.dev/
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
|
|
||||||
|
# # AggregatorCA example.
|
||||||
|
# aggregatorCA:
|
||||||
|
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
|
||||||
|
# # The base64 encoded private key for service account token generation.
|
||||||
|
|
||||||
|
# # AggregatorCA example.
|
||||||
|
# serviceAccount:
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
|
||||||
|
# # API server specific configuration options.
|
||||||
|
# apiServer:
|
||||||
|
# image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
# # Extra arguments to supply to the API server.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: ServerSideApply=true
|
||||||
|
# http2-max-streams-per-connection: "32"
|
||||||
|
# # Extra certificate subject alternative names for the API server's certificate.
|
||||||
|
# certSANs:
|
||||||
|
# - 1.2.3.4
|
||||||
|
# - 4.5.6.7
|
||||||
|
# # Configure the API server admission plugins.
|
||||||
|
# admissionControl:
|
||||||
|
# - name: PodSecurity # Name is the name of the admission controller.
|
||||||
|
# # Configuration is an embedded configuration object to be used as the plugin's
|
||||||
|
# configuration:
|
||||||
|
# apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||||
|
# defaults:
|
||||||
|
# audit: restricted
|
||||||
|
# audit-version: latest
|
||||||
|
# enforce: baseline
|
||||||
|
# enforce-version: latest
|
||||||
|
# warn: restricted
|
||||||
|
# warn-version: latest
|
||||||
|
# exemptions:
|
||||||
|
# namespaces:
|
||||||
|
# - kube-system
|
||||||
|
# runtimeClasses: []
|
||||||
|
# usernames: []
|
||||||
|
# kind: PodSecurityConfiguration
|
||||||
|
# # Configure the API server audit policy.
|
||||||
|
# auditPolicy:
|
||||||
|
# apiVersion: audit.k8s.io/v1
|
||||||
|
# kind: Policy
|
||||||
|
# rules:
|
||||||
|
# - level: Metadata
|
||||||
|
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||||
|
# authorizationConfig:
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: webhook # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: Deny
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# matchConditions:
|
||||||
|
# - expression: has(request.resourceAttributes)
|
||||||
|
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: NoOpinion
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
|
||||||
|
# # Controller manager server specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
||||||
|
# # Extra arguments to supply to the controller manager.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: ServerSideApply=true
|
||||||
|
|
||||||
|
# # Kube-proxy server-specific configuration options
|
||||||
|
# proxy:
|
||||||
|
# disabled: false # Disable kube-proxy deployment on cluster bootstrap.
|
||||||
|
# image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
||||||
|
# mode: ipvs # proxy mode of kube-proxy.
|
||||||
|
# # Extra arguments to supply to kube-proxy.
|
||||||
|
# extraArgs:
|
||||||
|
# proxy-mode: iptables
|
||||||
|
|
||||||
|
# # Scheduler server specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
||||||
|
# # Extra arguments to supply to the scheduler.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: AllBeta=true
|
||||||
|
|
||||||
|
# # Etcd specific configuration options.
|
||||||
|
# etcd:
|
||||||
|
# image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service.
|
||||||
|
# # The `ca` is the root certificate authority of the PKI.
|
||||||
|
# ca:
|
||||||
|
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
# # Extra arguments to supply to etcd.
|
||||||
|
# extraArgs:
|
||||||
|
# election-timeout: "5000"
|
||||||
|
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||||
|
# advertisedSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
|
||||||
|
# # Core DNS specific configuration options.
|
||||||
|
# coreDNS:
|
||||||
|
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
||||||
|
|
||||||
|
# # External cloud provider configuration.
|
||||||
|
# externalCloudProvider:
|
||||||
|
# enabled: true # Enable external cloud provider.
|
||||||
|
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||||
|
# manifests:
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||||
|
|
||||||
|
# # A list of urls that point to additional manifests.
|
||||||
|
# extraManifests:
|
||||||
|
# - https://www.example.com/manifest1.yaml
|
||||||
|
# - https://www.example.com/manifest2.yaml
|
||||||
|
|
||||||
|
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||||
|
# extraManifestHeaders:
|
||||||
|
# Token: "1234567"
|
||||||
|
# X-ExtraInfo: info
|
||||||
|
|
||||||
|
# # A list of inline Kubernetes manifests.
|
||||||
|
# inlineManifests:
|
||||||
|
# - name: namespace-ci # Name of the manifest.
|
||||||
|
# contents: |- # Manifest contents as a string.
|
||||||
|
# apiVersion: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# metadata:
|
||||||
|
# name: ci
|
||||||
|
|
||||||
|
# # Settings for admin kubeconfig generation.
|
||||||
|
# adminKubeconfig:
|
||||||
|
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||||
|
|
||||||
|
# # Allows running workload on control-plane nodes.
|
||||||
|
# allowSchedulingOnControlPlanes: true
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
hostname: talos-worker2
|
||||||
|
# hostname: controlplane1.example.org
|
||||||
432
talos/configs/talos-worker3.yaml
Normal file
432
talos/configs/talos-worker3.yaml
Normal file
|
|
@ -0,0 +1,432 @@
|
||||||
|
version: v1alpha1 # Indicates the schema used to decode the contents.
|
||||||
|
debug: false # Enable verbose logging to the console.
|
||||||
|
persist: true
|
||||||
|
# Provides machine specific configuration options.
|
||||||
|
machine:
|
||||||
|
type: worker # Defines the role of the machine within the cluster.
|
||||||
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
|
# The root certificate authority of the PKI.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: ""
|
||||||
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
|
certSANs: []
|
||||||
|
# # Uncomment this to enable SANs.
|
||||||
|
# - 10.0.0.10
|
||||||
|
# - 172.16.0.10
|
||||||
|
# - 192.168.0.10
|
||||||
|
|
||||||
|
# Used to provide additional options to the kubelet.
|
||||||
|
kubelet:
|
||||||
|
image: ghcr.io/siderolabs/kubelet:v1.35.0 # The `image` field is an optional reference to an alternative kubelet image.
|
||||||
|
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
|
||||||
|
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
|
||||||
|
|
||||||
|
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
|
||||||
|
# clusterDNS:
|
||||||
|
# - 10.96.0.10
|
||||||
|
# - 169.254.2.53
|
||||||
|
|
||||||
|
# # The `extraArgs` field is used to provide additional flags to the kubelet.
|
||||||
|
# extraArgs:
|
||||||
|
# key: value
|
||||||
|
|
||||||
|
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
|
||||||
|
# extraMounts:
|
||||||
|
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
|
||||||
|
# type: bind # Type specifies the mount kind.
|
||||||
|
# source: /var/lib/example # Source specifies the source path of the mount.
|
||||||
|
# # Options are fstab style mount options.
|
||||||
|
# options:
|
||||||
|
# - bind
|
||||||
|
# - rshared
|
||||||
|
# - rw
|
||||||
|
|
||||||
|
# # The `extraConfig` field is used to provide kubelet configuration overrides.
|
||||||
|
# extraConfig:
|
||||||
|
# serverTLSBootstrap: true
|
||||||
|
|
||||||
|
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
|
||||||
|
# credentialProviderConfig:
|
||||||
|
# apiVersion: kubelet.config.k8s.io/v1
|
||||||
|
# kind: CredentialProviderConfig
|
||||||
|
# providers:
|
||||||
|
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||||
|
# defaultCacheDuration: 12h
|
||||||
|
# matchImages:
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.*.amazonaws.com.cn'
|
||||||
|
# - '*.dkr.ecr-fips.*.amazonaws.com'
|
||||||
|
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
|
||||||
|
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
|
||||||
|
# name: ecr-credential-provider
|
||||||
|
|
||||||
|
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
|
||||||
|
# nodeIP:
|
||||||
|
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
|
||||||
|
# validSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
# - '!10.0.0.3/32'
|
||||||
|
# - fdc7::/16
|
||||||
|
# Provides machine specific network configuration options.
|
||||||
|
network:
|
||||||
|
|
||||||
|
# # Configures KubeSpan feature.
|
||||||
|
# kubespan:
|
||||||
|
# enabled: true # Enable the KubeSpan feature.
|
||||||
|
# Used to provide instructions for installations.
|
||||||
|
install:
|
||||||
|
disk: /dev/sda # The disk used for installations.
|
||||||
|
image: ghcr.io/siderolabs/installer:v1.12.1 # Allows for supplying the image used to perform the installation.
|
||||||
|
wipe: false # Indicates if the installation disk should be wiped at installation time.
|
||||||
|
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
|
||||||
|
extraKernelArgs:
|
||||||
|
- console=tty0
|
||||||
|
|
||||||
|
# # Look up disk using disk attributes like model, size, serial and others.
|
||||||
|
# diskSelector:
|
||||||
|
# size: 4GB # Disk size.
|
||||||
|
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
|
||||||
|
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
|
||||||
|
registries: {}
|
||||||
|
# Features describe individual Talos features that can be switched on or off.
|
||||||
|
features:
|
||||||
|
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
|
||||||
|
# KubePrism - local proxy/load balancer on defined port that will distribute
|
||||||
|
kubePrism:
|
||||||
|
enabled: true # Enable KubePrism support - will start local load balancing proxy.
|
||||||
|
port: 7445 # KubePrism port.
|
||||||
|
# Configures host DNS caching resolver.
|
||||||
|
hostDNS:
|
||||||
|
enabled: true # Enable host DNS caching resolver.
|
||||||
|
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
|
||||||
|
|
||||||
|
# # Configure Talos API access from Kubernetes pods.
|
||||||
|
# kubernetesTalosAPIAccess:
|
||||||
|
# enabled: true # Enable Talos API access from Kubernetes pods.
|
||||||
|
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
|
||||||
|
# allowedRoles:
|
||||||
|
# - os:reader
|
||||||
|
# # The list of Kubernetes namespaces Talos API access is available from.
|
||||||
|
# allowedKubernetesNamespaces:
|
||||||
|
# - kube-system
|
||||||
|
|
||||||
|
# # Provides machine specific control plane configuration options.
|
||||||
|
|
||||||
|
# # ControlPlane definition example.
|
||||||
|
# controlPlane:
|
||||||
|
# # Controller manager machine specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# disabled: false # Disable kube-controller-manager on the node.
|
||||||
|
# # Scheduler machine specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# disabled: true # Disable kube-scheduler on the node.
|
||||||
|
|
||||||
|
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
|
||||||
|
|
||||||
|
# # nginx static pod.
|
||||||
|
# pods:
|
||||||
|
# - apiVersion: v1
|
||||||
|
# kind: pod
|
||||||
|
# metadata:
|
||||||
|
# name: nginx
|
||||||
|
# spec:
|
||||||
|
# containers:
|
||||||
|
# - image: nginx
|
||||||
|
# name: nginx
|
||||||
|
|
||||||
|
# # Allows the addition of user specified files.
|
||||||
|
|
||||||
|
# # MachineFiles usage example.
|
||||||
|
# files:
|
||||||
|
# - content: '...' # The contents of the file.
|
||||||
|
# permissions: 0o666 # The file's permissions in octal.
|
||||||
|
# path: /tmp/file.txt # The path of the file.
|
||||||
|
# op: append # The operation to use
|
||||||
|
|
||||||
|
# # The `env` field allows for the addition of environment variables.
|
||||||
|
|
||||||
|
# # Environment variables definition examples.
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: info
|
||||||
|
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
|
||||||
|
# https_proxy: http://SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# GRPC_GO_LOG_SEVERITY_LEVEL: error
|
||||||
|
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
# env:
|
||||||
|
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysctls.
|
||||||
|
|
||||||
|
# # MachineSysctls usage example.
|
||||||
|
# sysctls:
|
||||||
|
# kernel.domainname: talos.dev
|
||||||
|
# net.ipv4.ip_forward: "0"
|
||||||
|
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
|
||||||
|
|
||||||
|
# # Used to configure the machine's sysfs.
|
||||||
|
|
||||||
|
# # MachineSysfs usage example.
|
||||||
|
# sysfs:
|
||||||
|
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
|
||||||
|
|
||||||
|
# # Configures the udev system.
|
||||||
|
# udev:
|
||||||
|
# # List of udev rules to apply to the udev system
|
||||||
|
# rules:
|
||||||
|
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
|
||||||
|
|
||||||
|
# # Configures the logging system.
|
||||||
|
# logging:
|
||||||
|
# # Logging destination.
|
||||||
|
# destinations:
|
||||||
|
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
|
||||||
|
# format: json_lines # Logs format.
|
||||||
|
|
||||||
|
# # Configures the kernel.
|
||||||
|
# kernel:
|
||||||
|
# # Kernel modules to load.
|
||||||
|
# modules:
|
||||||
|
# - name: btrfs # Module name.
|
||||||
|
|
||||||
|
# # Configures the seccomp profiles for the machine.
|
||||||
|
# seccompProfiles:
|
||||||
|
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
|
||||||
|
# # The `value` field is used to provide the seccomp profile.
|
||||||
|
# value:
|
||||||
|
# defaultAction: SCMP_ACT_LOG
|
||||||
|
|
||||||
|
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
|
||||||
|
|
||||||
|
# # override default open file limit
|
||||||
|
# baseRuntimeSpecOverrides:
|
||||||
|
# process:
|
||||||
|
# rlimits:
|
||||||
|
# - hard: 1024
|
||||||
|
# soft: 1024
|
||||||
|
# type: RLIMIT_NOFILE
|
||||||
|
|
||||||
|
# # Configures the node labels for the machine.
|
||||||
|
|
||||||
|
# # node labels example.
|
||||||
|
# nodeLabels:
|
||||||
|
# exampleLabel: exampleLabelValue
|
||||||
|
|
||||||
|
# # Configures the node annotations for the machine.
|
||||||
|
|
||||||
|
# # node annotations example.
|
||||||
|
# nodeAnnotations:
|
||||||
|
# customer.io/rack: r13a25
|
||||||
|
|
||||||
|
# # Configures the node taints for the machine. Effect is optional.
|
||||||
|
|
||||||
|
# # node taints example.
|
||||||
|
# nodeTaints:
|
||||||
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
|
# Provides cluster specific configuration options.
|
||||||
|
cluster:
|
||||||
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
|
# Provides control plane specific configuration options.
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
clusterName: home-cluster # Configures the cluster's name.
|
||||||
|
# Provides cluster specific network configuration options.
|
||||||
|
network:
|
||||||
|
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
|
||||||
|
# The pod subnet CIDR.
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
# The service subnet CIDR.
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
|
||||||
|
# # The CNI used.
|
||||||
|
# cni:
|
||||||
|
# name: custom # Name of CNI to use.
|
||||||
|
# # URLs containing manifests to apply for the CNI.
|
||||||
|
# urls:
|
||||||
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
|
ca:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: ""
|
||||||
|
# Configures cluster member discovery.
|
||||||
|
discovery:
|
||||||
|
enabled: true # Enable the cluster membership discovery feature.
|
||||||
|
# Configure registries used for cluster member discovery.
|
||||||
|
registries:
|
||||||
|
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
|
||||||
|
kubernetes:
|
||||||
|
disabled: true # Disable Kubernetes discovery registry.
|
||||||
|
# Service registry is using an external service to push and pull information about cluster members.
|
||||||
|
service: {}
|
||||||
|
# # External service endpoint.
|
||||||
|
# endpoint: https://discovery.talos.dev/
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
|
|
||||||
|
# # Decryption secret example (do not use in production!).
|
||||||
|
# secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
|
||||||
|
|
||||||
|
# # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
|
|
||||||
|
# # AggregatorCA example.
|
||||||
|
# aggregatorCA:
|
||||||
|
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
|
||||||
|
# # The base64 encoded private key for service account token generation.
|
||||||
|
|
||||||
|
# # AggregatorCA example.
|
||||||
|
# serviceAccount:
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
|
||||||
|
# # API server specific configuration options.
|
||||||
|
# apiServer:
|
||||||
|
# image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
# # Extra arguments to supply to the API server.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: ServerSideApply=true
|
||||||
|
# http2-max-streams-per-connection: "32"
|
||||||
|
# # Extra certificate subject alternative names for the API server's certificate.
|
||||||
|
# certSANs:
|
||||||
|
# - 1.2.3.4
|
||||||
|
# - 4.5.6.7
|
||||||
|
# # Configure the API server admission plugins.
|
||||||
|
# admissionControl:
|
||||||
|
# - name: PodSecurity # Name is the name of the admission controller.
|
||||||
|
# # Configuration is an embedded configuration object to be used as the plugin's
|
||||||
|
# configuration:
|
||||||
|
# apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||||
|
# defaults:
|
||||||
|
# audit: restricted
|
||||||
|
# audit-version: latest
|
||||||
|
# enforce: baseline
|
||||||
|
# enforce-version: latest
|
||||||
|
# warn: restricted
|
||||||
|
# warn-version: latest
|
||||||
|
# exemptions:
|
||||||
|
# namespaces:
|
||||||
|
# - kube-system
|
||||||
|
# runtimeClasses: []
|
||||||
|
# usernames: []
|
||||||
|
# kind: PodSecurityConfiguration
|
||||||
|
# # Configure the API server audit policy.
|
||||||
|
# auditPolicy:
|
||||||
|
# apiVersion: audit.k8s.io/v1
|
||||||
|
# kind: Policy
|
||||||
|
# rules:
|
||||||
|
# - level: Metadata
|
||||||
|
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
|
||||||
|
# authorizationConfig:
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: webhook # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: Deny
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# matchConditions:
|
||||||
|
# - expression: has(request.resourceAttributes)
|
||||||
|
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
|
||||||
|
# name: in-cluster-authorizer # Name is used to describe the authorizer.
|
||||||
|
# # webhook is the configuration for the webhook authorizer.
|
||||||
|
# webhook:
|
||||||
|
# connectionInfo:
|
||||||
|
# type: InClusterConfig
|
||||||
|
# failurePolicy: NoOpinion
|
||||||
|
# matchConditionSubjectAccessReviewVersion: v1
|
||||||
|
# subjectAccessReviewVersion: v1
|
||||||
|
# timeout: 3s
|
||||||
|
|
||||||
|
# # Controller manager server specific configuration options.
|
||||||
|
# controllerManager:
|
||||||
|
# image: registry.k8s.io/kube-controller-manager:v1.35.0 # The container image used in the controller manager manifest.
|
||||||
|
# # Extra arguments to supply to the controller manager.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: ServerSideApply=true
|
||||||
|
|
||||||
|
# # Kube-proxy server-specific configuration options
|
||||||
|
# proxy:
|
||||||
|
# disabled: false # Disable kube-proxy deployment on cluster bootstrap.
|
||||||
|
# image: registry.k8s.io/kube-proxy:v1.35.0 # The container image used in the kube-proxy manifest.
|
||||||
|
# mode: ipvs # proxy mode of kube-proxy.
|
||||||
|
# # Extra arguments to supply to kube-proxy.
|
||||||
|
# extraArgs:
|
||||||
|
# proxy-mode: iptables
|
||||||
|
|
||||||
|
# # Scheduler server specific configuration options.
|
||||||
|
# scheduler:
|
||||||
|
# image: registry.k8s.io/kube-scheduler:v1.35.0 # The container image used in the scheduler manifest.
|
||||||
|
# # Extra arguments to supply to the scheduler.
|
||||||
|
# extraArgs:
|
||||||
|
# feature-gates: AllBeta=true
|
||||||
|
|
||||||
|
# # Etcd specific configuration options.
|
||||||
|
# etcd:
|
||||||
|
# image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service.
|
||||||
|
# # The `ca` is the root certificate authority of the PKI.
|
||||||
|
# ca:
|
||||||
|
# crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
|
||||||
|
# key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
|
||||||
|
# # Extra arguments to supply to etcd.
|
||||||
|
# extraArgs:
|
||||||
|
# election-timeout: "5000"
|
||||||
|
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
|
||||||
|
# advertisedSubnets:
|
||||||
|
# - 10.0.0.0/8
|
||||||
|
|
||||||
|
# # Core DNS specific configuration options.
|
||||||
|
# coreDNS:
|
||||||
|
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
|
||||||
|
|
||||||
|
# # External cloud provider configuration.
|
||||||
|
# externalCloudProvider:
|
||||||
|
# enabled: true # Enable external cloud provider.
|
||||||
|
# # A list of urls that point to additional manifests for an external cloud provider.
|
||||||
|
# manifests:
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
|
||||||
|
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
|
||||||
|
|
||||||
|
# # A list of urls that point to additional manifests.
|
||||||
|
# extraManifests:
|
||||||
|
# - https://www.example.com/manifest1.yaml
|
||||||
|
# - https://www.example.com/manifest2.yaml
|
||||||
|
|
||||||
|
# # A map of key value pairs that will be added while fetching the extraManifests.
|
||||||
|
# extraManifestHeaders:
|
||||||
|
# Token: "1234567"
|
||||||
|
# X-ExtraInfo: info
|
||||||
|
|
||||||
|
# # A list of inline Kubernetes manifests.
|
||||||
|
# inlineManifests:
|
||||||
|
# - name: namespace-ci # Name of the manifest.
|
||||||
|
# contents: |- # Manifest contents as a string.
|
||||||
|
# apiVersion: v1
|
||||||
|
# kind: Namespace
|
||||||
|
# metadata:
|
||||||
|
# name: ci
|
||||||
|
|
||||||
|
# # Settings for admin kubeconfig generation.
|
||||||
|
# adminKubeconfig:
|
||||||
|
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
|
||||||
|
|
||||||
|
# # Allows running workload on control-plane nodes.
|
||||||
|
# allowSchedulingOnControlPlanes: true
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
hostname: talos-worker3
|
||||||
|
# hostname: controlplane1.example.org
|
||||||
|
|
@ -4,11 +4,11 @@ persist: true
|
||||||
# Provides machine specific configuration options.
|
# Provides machine specific configuration options.
|
||||||
machine:
|
machine:
|
||||||
type: controlplane # Defines the role of the machine within the cluster.
|
type: controlplane # Defines the role of the machine within the cluster.
|
||||||
token: 6mvqo9.nn5sbv4fhyifbqjk # The `token` is used by a machine to join the PKI of the cluster.
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
# The root certificate authority of the PKI.
|
# The root certificate authority of the PKI.
|
||||||
ca:
|
ca:
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRFl1WkVJcC9ONEhLNG9RcndlcnlvZUVYNkt4WFFzWUcyeDRXV3ZxTVM4eAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
# Extra certificate subject alternative names for the machine's certificate.
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
certSANs: []
|
certSANs: []
|
||||||
# # Uncomment this to enable SANs.
|
# # Uncomment this to enable SANs.
|
||||||
|
|
@ -220,8 +220,8 @@ machine:
|
||||||
# exampleTaint: exampleTaintValue:NoSchedule
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
# Provides cluster specific configuration options.
|
# Provides cluster specific configuration options.
|
||||||
cluster:
|
cluster:
|
||||||
id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM= # Shared secret of cluster (base64 encoded random 32 bytes).
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
# Provides control plane specific configuration options.
|
# Provides control plane specific configuration options.
|
||||||
controlPlane:
|
controlPlane:
|
||||||
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
|
@ -242,19 +242,19 @@ cluster:
|
||||||
# # URLs containing manifests to apply for the CNI.
|
# # URLs containing manifests to apply for the CNI.
|
||||||
# urls:
|
# urls:
|
||||||
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
token: fkth11.nmhzlprifn9pe6jl # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
secretboxEncryptionSecret: 83iFqNeoP3fTSwstgBRWidjicy//f71Ui83VVcqI6So= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
|
||||||
# The base64 encoded root certificate authority used by Kubernetes.
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
ca:
|
ca:
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlQYklVSWtZWnRVaDI4Z2dqZERsbmp3bUVUWDJ0eEtpV2I2ek1xMTA2aDRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaVViOG1MMkFQM3k5Y0VsL2xVSTFTY2VjdUlmdERKQ0F1VzIwdGY0OGhQSnBPSzZ3aWRBTgp6OUxyR1Q0dFIwbnlUc3JEQUpjOFcwZnBJeHpoTXkvWHFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
|
||||||
aggregatorCA:
|
aggregatorCA:
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRREFKZDVPVGdJbnFnZ0NnMUUrNmFaVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhNVEUzTWpBeU9Wb1hEVE0yTURFd09URTNNakF5T1Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTi9oNms5MEMzT0VLOWlLY3daZEFvWFVXNDBXY0JFWnNEYnRxamMwWkI5cUxseHpLMkdYCnZZZHVsODJ4c1JiTjlXVjFoS085NjZCc2w5TXF2ZDAvOXJHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVpTGtETGhmcVQ5OUJ4VVBUVFBOa2tyUG1xRkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFQOXJxVHhXeEFWRXA2MElnNkgxSDJNaVpxc20waXlTSWFGNktHSDhGRDB5QWlCWkhWRml1SzFvKzZUWEt6QzkKSnNjait3emhuSTZWYUNQU2pEUUt3NGFrYkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTYXNCall3ZDAzcjZxRUFJaXNCTU9lWm5Dd3BRcm54cnE5T1JNZnFkT01vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMytIcVQzUUxjNFFyMklwekJsMENoZFJialJad0VSbXdOdTJxTnpSa0gyb3VYSE1yWVplOQpoMjZYemJHeEZzMzFaWFdFbzczcm9HeVgweXE5M1QvMnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
# The base64 encoded private key for service account token generation.
|
# The base64 encoded private key for service account token generation.
|
||||||
serviceAccount:
|
serviceAccount:
|
||||||
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBOXRQbWRWMDFYTWNXenAzc3RXS3p3NHFDcW9kZDVjaXVQanF2MXQ5VkcxbHRQNEJTCmlVS3U3VERTS3R4Zm1qQ3pMLzVvVHVwMUVPbDRHckVOK0RZNDhvZjN1MU1VdDdjWE9lelF5SXBLaitDMUJyRTEKQ29pNTFOUHdXNGpUaHRPTExXUmRrU2doUCtPaDM0alpzelBvczVvS1E4aFJtK1hZNzRjbytPZ3lOL2NORXQzNQowa3h1aVEyUzZPam51Z0tIZk9zOFhRL2d0cDloSitUYW0zdkpTSHdOUFpOVkFHb3dYSmQrRU5PeEhMWjlLSDIrCmNOcmpNZGUvbmZza3lvV2h1NXZFZnQxTmV0ZkEwWXZSb1hzZERqdS82YXJ5NW92MWNoMDJYVENhc0tLN05RajAKT1Y2REVqZm5PTlNRRndXRUpTVzY4RVlWY1AxSCtoY3E4VkozODM3b0JyWVpUWUNFZllMaC8rNnpZY3RjSGdLTAo5VFhvdkxkTlZLaDlpZ0Q5NVlsT3lsTmpCVlVDNm45Q0RPQ3BZWDUzaXdiTGl1VFVsRUNwK3g0eCtrcVlPUFNDCmFrWVhwZXZ2R1F0STFUTDFLK2lDamNXUm9EaVZoblFWREhsV243R3pqeFNKMEJWd25ydFk3aWlXR1JmemxMTVUKQzUrVVY3TGxSaytwMFlDMG85dmczbXZQNkJRTm5NQUtETGc5MG5PSjVzZWFkR21DQVdyVnI2TjhhaDR2ZmpGdQprUkVVa29vcjZmYXlERmxpN1pQWGYzaXVLY0FiNXhXb3JoTXVvR0tzMUFRZHdLZFdUZi9janVKOVJYR2lLSXJ2ClJWQWQ4TW82MGhKd25SRElCK1M0cUNOWXlvYXQxd2x4NldCcjQyRUZ2ekFxdk41Z0thOVBQR09KOEJjQ0F3RUEKQVFLQ0FnQml4dXc4WFovRVVEdzFWWWZzRXVManh5T0JnUWkzczNiZm1uYlNJN0FZY05KQ2ptVDVYMEZIMUxqVwp4RGhTS1ZrY1JOQ1RmRXA3Q1NPeWN0YW5WWE8ydzJrRmd6c1FSbW82R1NaNGlyZEtHdC8zSEtXZ1lKVVZzZmRICmVsdEVZcFlaQlVoWWxkbXdpclUyRXJza2R3cVNEWHc4SWdkZXZ6M3dwWU5sRU84LzdGTkVFS2N3WEx3RGh2WWEKMVZJZTQzSTdNSnlJbFprVkhIVXlGT2pUUGxlUDlXMExEbEgvQjMveEhnTXFVcjFYUTBTVkZyVkd6cUlMU1U3Ngp0dzNES25WTjhnbFJ4OWlBNTZUWGR2L2VncmxlLzlST2U4WVhNejEzZkc5TUhlNVo3OVhCWktMdjduMi9wYldYCnphRVlSWEhidDl5MjJTVXRnWDd6ZTZBSTBUc0U0clIrY0RCZndwcm9ZSHpSRUdlb2t4a0JucHRSNG1YNkNyYm8KYUxZdTJiTWpzd0dCclE5VEJiTk9vNjVkOExRV3JlaGNFY0ZSbWxXN2JCT2M5N3FVbUIvakZGSXhQMUk5NjY5WgpveXpuZ2tzcHZISHZXR2NVTTRsMVkxYkhXNCtOUFpaUk9uOFc4dGJKT2hTNjZ2YTdFQ3pnb2QzRC9aSmFmdlViCkRjTlNCdVltZTZsUisvU1Z6SEcvOTROQVZJdmdPdVVxVWxqbmlpNnRtUFBqUEduNXlNTmZ4QUN4aEJlQmZJNCsKbitqc2V4UGtHamhrSjdPVDVKQjYxQWFId28wdjJ3Y212a0I1YkE3cEo3K0k4OUp1bE9VM3V2eXQ2OUQ2b1k0agpEQk00ZVVVd3ArZ3c1ZHVMYWpES2w0cno5SHNQQllPSUpDNE9uUE5wdXRlb2tzWWEyUUtDQVFFQS82YlpGYkI3CkZ2dGdxYkozV0ZEL1BjcjFwbnljakI4ZFZObVNBN0FhVHZaZll5THovbHlJM0VUQkJUbkhWUk9YVy9qa2VYcGcKa1FpRGRLbzlZS2g3Y1EwdTBwVnVDeGNOdXRkRmIwRkROMERvWjNuRlJlSkpEcmh2c2gyRDkvMGdaTmw2Tkg0dApPMUxWUDBGUStpeTZ5TGlUci9XelVZYVc1OHVNcmw2cFUxRStQTjJPQ1l4bnBmVk0vbFJQbHdJUFF5ZUYrc3krCkZibjBnVTArOEJHY0R6aDJZZldBZ1J4OUt5RStNcWtROVdIQzY2MXZkUGFPdm5ROTY3Y2xTRE5kU3FiRFRuU3EKSlExbVdLT0c3RzJXRGtDcmw0RElZU0tQQUZCeWowbGcxeCtjQ1JoN1hZOUtDVnZxMmFkcXJOZ1A4UHZmblFpdwpGcThuSWE1UnNhM3Y5UUtDQVFFQTl5bjVuNW5rQUd4Z2JlSEF4MnFMbWFBNHRvUGVHUkxHeUdCWU9Wa3RtSFN5Ck4rS2tvamw4ZmEyN0ppTVVNWHRONzhsSzdNM3lGQldSWENocUgvaURZYmtVZFNLUk4yTFJBRWtudTkxTWVVTWkKV1pmMVo5QzNpL2JlUmV4aEl0aGFNQkk2YldQeTMzTExYREdsZXlmTnp6N21nNFVOQm5relp6aUMwRjN0NUlMcgp5WG1VdDZxUjNPQlBIcUhDZXhTeERqQVk4ZDBXTjhQejk0YUJkNW1pelBEQ1FwYkFuTmZ4NFVGU0Z5N2hRRGVrCkFQUm5MY0tacXZibGJzT3JlUUo3TUJXV1h6U3VwYnUxL2krYTNwZWNwMTRmek9HMC9GaDh0c1JQTUtHNFNDcDYKQ2lOVm55T210MGRHaWxaOXV4emRVZVF6RXBSZk93YkF6UlNqYW95VVd3S0NBUUVBMDBLQWovRFh0dVVpT3ZsVQpzREcyeXN5R2RQN3lxc1FuaSsrRFB2THV1cVBUcld1NzcwMXVkMytGZGhrS0JONzhyQzhnTnRhUEtDcTkzdEd6CmlNV1J4SmxkUVAzbEF0c1pLSFl1VmNLN2xkUlllUEhpdUY1SGV4ZWtqYTdnV0RUZjZSYmlhckIrRmxEY0VicWEKL1RHclpLVkt2aFN2QzBiS08yQTByLzlmczQ4bWZFdWx6WFF1VHJGSDM3K3lTWnFWSEN4MEJnM2RZcnpaTldTdApCdHUyZDhsejRuMXFwTWJ6RklvVENQQTNLRitTSVFtZ1dpcEpTVTlydi9jSG93TjNLM0psWU5iOXAwTE1lYUVnCnBRM2wrMzhyalRZSjRHTWJndW4zMFRxVkFSQ0k4K2M4UXROZkhoN01FdkxMTDJ3WXVFNmJ1ZnZzNzhIcjkyUkMKOUM1RlpRS0NBUUVBb2pxaTVlY1VpRkthV0lVOUM2Y2JTaEtvSnVRVyswNGZ1NVhCVXFMK0VudEdIdmhjSno2awpQN213aFMreEtXbE5sbjRBOTcyVmp5azQ1OHgvRzh6NkwwSlQ4eTVsTW4xaHdWWkRCa1FTMWVVQ3Z0dkc4QVZHCjlFOXRSV2dKdWQxWUZRVmg1RHNlUnh3Sjd0R0hWSGFqMTh2cGNabjdHcXlpMkxWMjUxMC9zQ1ZlcmpkbkxjWi8KUndMVDY3OHc3Nmg5TGxyVGhLMGcwQ21HRUlud29KZnZDNlZiWEdtbXMwdnFMM2U0Y2c4TE9pTkxPblV3NUJBKwozTUNCaDFwWFNtNGVmVWt1RWY5NlFyNGFqbVNndWttNVFRRyt6Yk80SDRuVkVnRjRHT3VORVpFUDJXZW40M1I3CkVRRnZnNDJScVNjZy9ZZFRIbmJVcXVHYjJ3QVk0dTZ5MFFLQ0FRRUFpQm0zbkUxTGg2VFFtZjlZQVVnV1pNeVkKQWlVSHNFUnRTUGdCdWgrZzUxY1krMmp2ckEvbVZ3bG5PQlphWmoreU52Tk5ESktoWUk3TDlFb2krbTlZM1duUAp4OGFlRndhNFBRMzhUU09wM0hSYXhtcUd2Ylo0aktqcVVSc3R3b1B2UzkyK2JGZUxyaFArREh2dmhOMW41TDNkCjZtdFQycjVpSkZWWEc1RVZWMGpUdkVMUVBDT013c0NVL2hyOVdCY0hpeFdIdzBGOGdZaEo2VjJ6WjB2ZEhTUHYKMTNhUWFHZlh4M0o2NEN4dy9CWmJPaUdnYUNOOEtBKzJhYmhLY2M1UTR5L21QRUN1WXRlVHJPMFZURU9GOHczMgpta29SOUUxWHI2RnowK1Z1b0puKzBXSWNkN0l5dS8ybHZzWjVPc2ltMVRkUS9VaFAvVjlsMHpweGhOYlJUQT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
|
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
# API server specific configuration options.
|
# API server specific configuration options.
|
||||||
apiServer:
|
apiServer:
|
||||||
image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
image: registry.k8s.io/kube-apiserver:v1.35.0 # The container image used in the API server manifest.
|
||||||
|
|
@ -337,8 +337,8 @@ cluster:
|
||||||
etcd:
|
etcd:
|
||||||
# The `ca` is the root certificate authority of the PKI.
|
# The `ca` is the root certificate authority of the PKI.
|
||||||
ca:
|
ca:
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNPZ0F3SUJBZ0lRRFV2eGpQbDViSFRSR05KN1VSQ0JzVEFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE1URTNNakF5T1ZvWERUTTJNREV3T1RFM01qQXlPVm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpWSlhnSGRMbTJFCjFSNmJyZjJ2aG91blBndlpzeVlsZFA5TlMzT0FXaGk1dUczc2JBTi96ZnF1VEtpOUFjQXpuOWNnbHY5MkI3MXkKQXNtMktPcUJXYTJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVOGpCellJc3RITjA2CjFNSDBsNjFRaXlibnFIa3dDZ1lJS29aSXpqMEVBd0lEUndBd1JBSWdWbDZ0SWw5MlN0YUtKWDhkVnpzKzJiWUgKQi9sTnlPbkx1eGNZTWsvL1lGTUNJQXZWT1ZMckQ4Q3hCMlgyMDREVVpOL0t6KzVZcHFtRy9yUTFiRnBDSkF1NwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||||
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVKaktuempHY1ViakNRekpkamF0cFNXUVlacnI2MHg4b1NNeEV3eUhkNUFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbFVsZUFkMHViWVRWSHB1dC9hK0dpNmMrQzltekppVjAvMDFMYzRCYUdMbTRiZXhzQTMvTgorcTVNcUwwQndET2YxeUNXLzNZSHZYSUN5YllvNm9GWnJRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
|
||||||
# # The container image used to create the etcd service.
|
# # The container image used to create the etcd service.
|
||||||
# image: registry.k8s.io/etcd:v3.6.7
|
# image: registry.k8s.io/etcd:v3.6.7
|
||||||
|
|
|
||||||
23
talos/secrets.yaml.backup
Normal file
23
talos/secrets.yaml.backup
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
cluster:
|
||||||
|
id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c=
|
||||||
|
secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM=
|
||||||
|
secrets:
|
||||||
|
bootstraptoken: fkth11.nmhzlprifn9pe6jl
|
||||||
|
secretboxencryptionsecret: 83iFqNeoP3fTSwstgBRWidjicy//f71Ui83VVcqI6So=
|
||||||
|
trustdinfo:
|
||||||
|
token: 6mvqo9.nn5sbv4fhyifbqjk
|
||||||
|
certs:
|
||||||
|
etcd:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmRENDQVNPZ0F3SUJBZ0lRRFV2eGpQbDViSFRSR05KN1VSQ0JzVEFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE1URTNNakF5T1ZvWERUTTJNREV3T1RFM01qQXlPVm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpWSlhnSGRMbTJFCjFSNmJyZjJ2aG91blBndlpzeVlsZFA5TlMzT0FXaGk1dUczc2JBTi96ZnF1VEtpOUFjQXpuOWNnbHY5MkI3MXkKQXNtMktPcUJXYTJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVOGpCellJc3RITjA2CjFNSDBsNjFRaXlibnFIa3dDZ1lJS29aSXpqMEVBd0lEUndBd1JBSWdWbDZ0SWw5MlN0YUtKWDhkVnpzKzJiWUgKQi9sTnlPbkx1eGNZTWsvL1lGTUNJQXZWT1ZMckQ4Q3hCMlgyMDREVVpOL0t6KzVZcHFtRy9yUTFiRnBDSkF1NwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVKaktuempHY1ViakNRekpkamF0cFNXUVlacnI2MHg4b1NNeEV3eUhkNUFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbFVsZUFkMHViWVRWSHB1dC9hK0dpNmMrQzltekppVjAvMDFMYzRCYUdMbTRiZXhzQTMvTgorcTVNcUwwQndET2YxeUNXLzNZSHZYSUN5YllvNm9GWnJRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
k8s:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUlQYklVSWtZWnRVaDI4Z2dqZERsbmp3bUVUWDJ0eEtpV2I2ek1xMTA2aDRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFaVViOG1MMkFQM3k5Y0VsL2xVSTFTY2VjdUlmdERKQ0F1VzIwdGY0OGhQSnBPSzZ3aWRBTgp6OUxyR1Q0dFIwbnlUc3JEQUpjOFcwZnBJeHpoTXkvWHFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
k8saggregator:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRREFKZDVPVGdJbnFnZ0NnMUUrNmFaVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhNVEUzTWpBeU9Wb1hEVE0yTURFd09URTNNakF5T1Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTi9oNms5MEMzT0VLOWlLY3daZEFvWFVXNDBXY0JFWnNEYnRxamMwWkI5cUxseHpLMkdYCnZZZHVsODJ4c1JiTjlXVjFoS085NjZCc2w5TXF2ZDAvOXJHallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVpTGtETGhmcVQ5OUJ4VVBUVFBOa2tyUG1xRkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFQOXJxVHhXeEFWRXA2MElnNkgxSDJNaVpxc20waXlTSWFGNktHSDhGRDB5QWlCWkhWRml1SzFvKzZUWEt6QzkKSnNjait3emhuSTZWYUNQU2pEUUt3NGFrYkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpTYXNCall3ZDAzcjZxRUFJaXNCTU9lWm5Dd3BRcm54cnE5T1JNZnFkT01vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMytIcVQzUUxjNFFyMklwekJsMENoZFJialJad0VSbXdOdTJxTnpSa0gyb3VYSE1yWVplOQpoMjZYemJHeEZzMzFaWFdFbzczcm9HeVgweXE5M1QvMnNRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
|
k8sserviceaccount:
|
||||||
|
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBOXRQbWRWMDFYTWNXenAzc3RXS3p3NHFDcW9kZDVjaXVQanF2MXQ5VkcxbHRQNEJTCmlVS3U3VERTS3R4Zm1qQ3pMLzVvVHVwMUVPbDRHckVOK0RZNDhvZjN1MU1VdDdjWE9lelF5SXBLaitDMUJyRTEKQ29pNTFOUHdXNGpUaHRPTExXUmRrU2doUCtPaDM0alpzelBvczVvS1E4aFJtK1hZNzRjbytPZ3lOL2NORXQzNQowa3h1aVEyUzZPam51Z0tIZk9zOFhRL2d0cDloSitUYW0zdkpTSHdOUFpOVkFHb3dYSmQrRU5PeEhMWjlLSDIrCmNOcmpNZGUvbmZza3lvV2h1NXZFZnQxTmV0ZkEwWXZSb1hzZERqdS82YXJ5NW92MWNoMDJYVENhc0tLN05RajAKT1Y2REVqZm5PTlNRRndXRUpTVzY4RVlWY1AxSCtoY3E4VkozODM3b0JyWVpUWUNFZllMaC8rNnpZY3RjSGdLTAo5VFhvdkxkTlZLaDlpZ0Q5NVlsT3lsTmpCVlVDNm45Q0RPQ3BZWDUzaXdiTGl1VFVsRUNwK3g0eCtrcVlPUFNDCmFrWVhwZXZ2R1F0STFUTDFLK2lDamNXUm9EaVZoblFWREhsV243R3pqeFNKMEJWd25ydFk3aWlXR1JmemxMTVUKQzUrVVY3TGxSaytwMFlDMG85dmczbXZQNkJRTm5NQUtETGc5MG5PSjVzZWFkR21DQVdyVnI2TjhhaDR2ZmpGdQprUkVVa29vcjZmYXlERmxpN1pQWGYzaXVLY0FiNXhXb3JoTXVvR0tzMUFRZHdLZFdUZi9janVKOVJYR2lLSXJ2ClJWQWQ4TW82MGhKd25SRElCK1M0cUNOWXlvYXQxd2x4NldCcjQyRUZ2ekFxdk41Z0thOVBQR09KOEJjQ0F3RUEKQVFLQ0FnQml4dXc4WFovRVVEdzFWWWZzRXVManh5T0JnUWkzczNiZm1uYlNJN0FZY05KQ2ptVDVYMEZIMUxqVwp4RGhTS1ZrY1JOQ1RmRXA3Q1NPeWN0YW5WWE8ydzJrRmd6c1FSbW82R1NaNGlyZEtHdC8zSEtXZ1lKVVZzZmRICmVsdEVZcFlaQlVoWWxkbXdpclUyRXJza2R3cVNEWHc4SWdkZXZ6M3dwWU5sRU84LzdGTkVFS2N3WEx3RGh2WWEKMVZJZTQzSTdNSnlJbFprVkhIVXlGT2pUUGxlUDlXMExEbEgvQjMveEhnTXFVcjFYUTBTVkZyVkd6cUlMU1U3Ngp0dzNES25WTjhnbFJ4OWlBNTZUWGR2L2VncmxlLzlST2U4WVhNejEzZkc5TUhlNVo3OVhCWktMdjduMi9wYldYCnphRVlSWEhidDl5MjJTVXRnWDd6ZTZBSTBUc0U0clIrY0RCZndwcm9ZSHpSRUdlb2t4a0JucHRSNG1YNkNyYm8KYUxZdTJiTWpzd0dCclE5VEJiTk9vNjVkOExRV3JlaGNFY0ZSbWxXN2JCT2M5N3FVbUIvakZGSXhQMUk5NjY5WgpveXpuZ2tzcHZISHZXR2NVTTRsMVkxYkhXNCtOUFpaUk9uOFc4dGJKT2hTNjZ2YTdFQ3pnb2QzRC9aSmFmdlViCkRjTlNCdVltZTZsUisvU1Z6SEcvOTROQVZJdmdPdVVxVWxqbmlpNnRtUFBqUEduNXlNTmZ4QUN4aEJlQmZJNCsKbitqc2V4UGtHamhrSjdPVDVKQjYxQWFId28wdjJ3Y212a0I1YkE3cEo3K0k4OUp1bE9VM3V2eXQ2OUQ2b1k0agpEQk00ZVVVd3ArZ3c1ZHVMYWpES2w0cno5SHNQQllPSUpDNE9uUE5wdXRlb2tzWWEyUUtDQVFFQS82YlpGYkI3CkZ2dGdxYkozV0ZEL1BjcjFwbnljakI4ZFZObVNBN0FhVHZaZll5THovbHlJM0VUQkJUbkhWUk9YVy9qa2VYcGcKa1FpRGRLbzlZS2g3Y1EwdTBwVnVDeGNOdXRkRmIwRkROMERvWjNuRlJlSkpEcmh2c2gyRDkvMGdaTmw2Tkg0dApPMUxWUDBGUStpeTZ5TGlUci9XelVZYVc1OHVNcmw2cFUxRStQTjJPQ1l4bnBmVk0vbFJQbHdJUFF5ZUYrc3krCkZibjBnVTArOEJHY0R6aDJZZldBZ1J4OUt5RStNcWtROVdIQzY2MXZkUGFPdm5ROTY3Y2xTRE5kU3FiRFRuU3EKSlExbVdLT0c3RzJXRGtDcmw0RElZU0tQQUZCeWowbGcxeCtjQ1JoN1hZOUtDVnZxMmFkcXJOZ1A4UHZmblFpdwpGcThuSWE1UnNhM3Y5UUtDQVFFQTl5bjVuNW5rQUd4Z2JlSEF4MnFMbWFBNHRvUGVHUkxHeUdCWU9Wa3RtSFN5Ck4rS2tvamw4ZmEyN0ppTVVNWHRONzhsSzdNM3lGQldSWENocUgvaURZYmtVZFNLUk4yTFJBRWtudTkxTWVVTWkKV1pmMVo5QzNpL2JlUmV4aEl0aGFNQkk2YldQeTMzTExYREdsZXlmTnp6N21nNFVOQm5relp6aUMwRjN0NUlMcgp5WG1VdDZxUjNPQlBIcUhDZXhTeERqQVk4ZDBXTjhQejk0YUJkNW1pelBEQ1FwYkFuTmZ4NFVGU0Z5N2hRRGVrCkFQUm5MY0tacXZibGJzT3JlUUo3TUJXV1h6U3VwYnUxL2krYTNwZWNwMTRmek9HMC9GaDh0c1JQTUtHNFNDcDYKQ2lOVm55T210MGRHaWxaOXV4emRVZVF6RXBSZk93YkF6UlNqYW95VVd3S0NBUUVBMDBLQWovRFh0dVVpT3ZsVQpzREcyeXN5R2RQN3lxc1FuaSsrRFB2THV1cVBUcld1NzcwMXVkMytGZGhrS0JONzhyQzhnTnRhUEtDcTkzdEd6CmlNV1J4SmxkUVAzbEF0c1pLSFl1VmNLN2xkUlllUEhpdUY1SGV4ZWtqYTdnV0RUZjZSYmlhckIrRmxEY0VicWEKL1RHclpLVkt2aFN2QzBiS08yQTByLzlmczQ4bWZFdWx6WFF1VHJGSDM3K3lTWnFWSEN4MEJnM2RZcnpaTldTdApCdHUyZDhsejRuMXFwTWJ6RklvVENQQTNLRitTSVFtZ1dpcEpTVTlydi9jSG93TjNLM0psWU5iOXAwTE1lYUVnCnBRM2wrMzhyalRZSjRHTWJndW4zMFRxVkFSQ0k4K2M4UXROZkhoN01FdkxMTDJ3WXVFNmJ1ZnZzNzhIcjkyUkMKOUM1RlpRS0NBUUVBb2pxaTVlY1VpRkthV0lVOUM2Y2JTaEtvSnVRVyswNGZ1NVhCVXFMK0VudEdIdmhjSno2awpQN213aFMreEtXbE5sbjRBOTcyVmp5azQ1OHgvRzh6NkwwSlQ4eTVsTW4xaHdWWkRCa1FTMWVVQ3Z0dkc4QVZHCjlFOXRSV2dKdWQxWUZRVmg1RHNlUnh3Sjd0R0hWSGFqMTh2cGNabjdHcXlpMkxWMjUxMC9zQ1ZlcmpkbkxjWi8KUndMVDY3OHc3Nmg5TGxyVGhLMGcwQ21HRUlud29KZnZDNlZiWEdtbXMwdnFMM2U0Y2c4TE9pTkxPblV3NUJBKwozTUNCaDFwWFNtNGVmVWt1RWY5NlFyNGFqbVNndWttNVFRRyt6Yk80SDRuVkVnRjRHT3VORVpFUDJXZW40M1I3CkVRRnZnNDJScVNjZy9ZZFRIbmJVcXVHYjJ3QVk0dTZ5MFFLQ0FRRUFpQm0zbkUxTGg2VFFtZjlZQVVnV1pNeVkKQWlVSHNFUnRTUGdCdWgrZzUxY1krMmp2ckEvbVZ3bG5PQlphWmoreU52Tk5ESktoWUk3TDlFb2krbTlZM1duUAp4OGFlRndhNFBRMzhUU09wM0hSYXhtcUd2Ylo0aktqcVVSc3R3b1B2UzkyK2JGZUxyaFArREh2dmhOMW41TDNkCjZtdFQycjVpSkZWWEc1RVZWMGpUdkVMUVBDT013c0NVL2hyOVdCY0hpeFdIdzBGOGdZaEo2VjJ6WjB2ZEhTUHYKMTNhUWFHZlh4M0o2NEN4dy9CWmJPaUdnYUNOOEtBKzJhYmhLY2M1UTR5L21QRUN1WXRlVHJPMFZURU9GOHczMgpta29SOUUxWHI2RnowK1Z1b0puKzBXSWNkN0l5dS8ybHZzWjVPc2ltMVRkUS9VaFAvVjlsMHpweGhOYlJUQT09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
|
||||||
|
os:
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJRFl1WkVJcC9ONEhLNG9RcndlcnlvZUVYNkt4WFFzWUcyeDRXV3ZxTVM4eAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
12
talos/talosconfig.backup
Normal file
12
talos/talosconfig.backup
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
context: home-cluster
|
||||||
|
contexts:
|
||||||
|
home-cluster:
|
||||||
|
endpoints:
|
||||||
|
- 10.0.15.1
|
||||||
|
- 10.0.15.2
|
||||||
|
- 10.0.15.3
|
||||||
|
nodes:
|
||||||
|
- 10.0.15.1
|
||||||
|
ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEJOcDFlRkxURkM3dlpLdzRxYk5hc0JNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TmpNME5UWmFGdzB5TnpBeE1UUXhOak0wTlRaYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWQ0WGFqeENScDFRZi9lZWJFRWxWa2pQS1BqZ3paZGJCCkRxUENBbGRCL1cyalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCUlV0V1RId3M3ZmRvem0wdzgyVGFBK00xb0hTREFGQmdNclpYQURRUUJ4Ni9FdgpsUHFJTFRaNHhPN0ZOM2xWNHdCdngrekpLbGE4ODdkbUtRWk50NEZUbmpadFh1eWQ5VEhaVXdsOXozN3RBUG1ZCjFxZzAzUW5ZR1lyVEt5NEQKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||||
|
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSXpScjY5NGp0SnRDWjZFbmp6cWhSWGREdndpa0h2eGErNzlCZzN1cDZpUAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
|
||||||
|
|
@ -4,10 +4,10 @@ persist: true
|
||||||
# Provides machine specific configuration options.
|
# Provides machine specific configuration options.
|
||||||
machine:
|
machine:
|
||||||
type: worker # Defines the role of the machine within the cluster.
|
type: worker # Defines the role of the machine within the cluster.
|
||||||
token: 6mvqo9.nn5sbv4fhyifbqjk # The `token` is used by a machine to join the PKI of the cluster.
|
token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster.
|
||||||
# The root certificate authority of the PKI.
|
# The root certificate authority of the PKI.
|
||||||
ca:
|
ca:
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJxdlBudGE0a2JsOVJoRXAyVmQzWjNNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVEV4TnpJd01qbGFGdzB6TmpBeE1Ea3hOekl3TWpsYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBWmlCdVZydmc5YzdocG1PNGpUTS9KZ05udEVEcE9CV2M5QzRNCkc2b0ZSTE9qWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVVkxWa3g4TE8zM2FNNXRNUApOazJnUGpOYUIwZ3dCUVlESzJWd0EwRUFIa1JQY0lBWnFLYUtDY0NTaXpiN3R6WXJ1U3JGUjNhM0RuN3JReTNOCmlpYkUxczVpRUMyMGdrdFFXSkJXSkxwRVpQa1F3Yml4aXB2ZTVUZE5EVFEyQ1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
key: ""
|
key: ""
|
||||||
# Extra certificate subject alternative names for the machine's certificate.
|
# Extra certificate subject alternative names for the machine's certificate.
|
||||||
certSANs: []
|
certSANs: []
|
||||||
|
|
@ -224,8 +224,8 @@ machine:
|
||||||
# exampleTaint: exampleTaintValue:NoSchedule
|
# exampleTaint: exampleTaintValue:NoSchedule
|
||||||
# Provides cluster specific configuration options.
|
# Provides cluster specific configuration options.
|
||||||
cluster:
|
cluster:
|
||||||
id: ajFbAfx06GXDzj6aZKEZ7M47wpc_0y4n9f4_NjIpz-c= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
|
||||||
secret: eZtUgfkU6glNR7S7O6n5uQBHb/m0pkb3QD9OlSo9cDM= # Shared secret of cluster (base64 encoded random 32 bytes).
|
secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes).
|
||||||
# Provides control plane specific configuration options.
|
# Provides control plane specific configuration options.
|
||||||
controlPlane:
|
controlPlane:
|
||||||
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
|
||||||
|
|
@ -246,10 +246,10 @@ cluster:
|
||||||
# # URLs containing manifests to apply for the CNI.
|
# # URLs containing manifests to apply for the CNI.
|
||||||
# urls:
|
# urls:
|
||||||
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
|
||||||
token: fkth11.nmhzlprifn9pe6jl # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
|
||||||
# The base64 encoded root certificate authority used by Kubernetes.
|
# The base64 encoded root certificate authority used by Kubernetes.
|
||||||
ca:
|
ca:
|
||||||
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpRENDQVMrZ0F3SUJBZ0lRSFp3TUhKd0ZyblVLTDMrNjltQ2JnVEFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNREV4TVRFM01qQXlPVm9YRFRNMk1ERXdPVEUzTWpBeQpPVm93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCSWxHL0ppOWdEOTh2WEJKZjVWQ05VbkhuTGlIN1F5UWdMbHR0TFgrUElUeWFUaXVzSW5RRGMvUzZ4aysKTFVkSjhrN0t3d0NYUEZ0SDZTTWM0VE12MTZpallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVyRU5ZMllVN3pWb1hoZ1BCb2Rqa1Z2Q2czWWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnV2xxb0ZXTzYKa3RnNEt3NVBtUkhUeVNuUi90cmQzTmQyc0x6WHdCRmFZcUlDSUNobFpCWDBHRGpQTVFjM0xQcG1oR2xpMVpCQgpzWkdyY0M4VVpqSjNqR0t4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
key: ""
|
key: ""
|
||||||
# Configures cluster member discovery.
|
# Configures cluster member discovery.
|
||||||
discovery:
|
discovery:
|
||||||
|
|
|
||||||
2
talosconfig
Normal file
2
talosconfig
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
context: ""
|
||||||
|
contexts: {}
|
||||||
|
|
@ -20,13 +20,16 @@ resource "proxmox_virtual_environment_vm" "talos_cp1" {
|
||||||
}
|
}
|
||||||
|
|
||||||
network_device {
|
network_device {
|
||||||
bridge = var.network_bridge
|
bridge = var.network_bridge
|
||||||
|
mac_address = "BC:24:11:9B:48:92"
|
||||||
}
|
}
|
||||||
|
|
||||||
lifecycle {
|
vga {
|
||||||
ignore_changes = [
|
type = "std"
|
||||||
network_device,
|
}
|
||||||
]
|
|
||||||
|
agent {
|
||||||
|
enabled = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -52,13 +55,16 @@ resource "proxmox_virtual_environment_vm" "talos_cp2" {
|
||||||
}
|
}
|
||||||
|
|
||||||
network_device {
|
network_device {
|
||||||
bridge = var.network_bridge
|
bridge = var.network_bridge
|
||||||
|
mac_address = "BC:24:11:62:7B:3F"
|
||||||
}
|
}
|
||||||
|
|
||||||
lifecycle {
|
vga {
|
||||||
ignore_changes = [
|
type = "std"
|
||||||
network_device,
|
}
|
||||||
]
|
|
||||||
|
agent {
|
||||||
|
enabled = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -84,13 +90,16 @@ resource "proxmox_virtual_environment_vm" "talos_cp3" {
|
||||||
}
|
}
|
||||||
|
|
||||||
network_device {
|
network_device {
|
||||||
bridge = var.network_bridge
|
bridge = var.network_bridge
|
||||||
|
mac_address = "BC:24:11:D4:2F:ED"
|
||||||
}
|
}
|
||||||
|
|
||||||
lifecycle {
|
vga {
|
||||||
ignore_changes = [
|
type = "std"
|
||||||
network_device,
|
}
|
||||||
]
|
|
||||||
|
agent {
|
||||||
|
enabled = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -116,13 +125,16 @@ resource "proxmox_virtual_environment_vm" "talos_worker1" {
|
||||||
}
|
}
|
||||||
|
|
||||||
network_device {
|
network_device {
|
||||||
bridge = var.network_bridge
|
bridge = var.network_bridge
|
||||||
|
mac_address = "BC:24:11:43:3F:FF"
|
||||||
}
|
}
|
||||||
|
|
||||||
lifecycle {
|
vga {
|
||||||
ignore_changes = [
|
type = "std"
|
||||||
network_device,
|
}
|
||||||
]
|
|
||||||
|
agent {
|
||||||
|
enabled = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -148,13 +160,16 @@ resource "proxmox_virtual_environment_vm" "talos_worker2" {
|
||||||
}
|
}
|
||||||
|
|
||||||
network_device {
|
network_device {
|
||||||
bridge = var.network_bridge
|
bridge = var.network_bridge
|
||||||
|
mac_address = "BC:24:11:62:C4:8F"
|
||||||
}
|
}
|
||||||
|
|
||||||
lifecycle {
|
vga {
|
||||||
ignore_changes = [
|
type = "std"
|
||||||
network_device,
|
}
|
||||||
]
|
|
||||||
|
agent {
|
||||||
|
enabled = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -180,12 +195,15 @@ resource "proxmox_virtual_environment_vm" "talos_worker3" {
|
||||||
}
|
}
|
||||||
|
|
||||||
network_device {
|
network_device {
|
||||||
bridge = var.network_bridge
|
bridge = var.network_bridge
|
||||||
|
mac_address = "BC:24:11:3F:8E:1A"
|
||||||
}
|
}
|
||||||
|
|
||||||
lifecycle {
|
vga {
|
||||||
ignore_changes = [
|
type = "std"
|
||||||
network_device,
|
}
|
||||||
]
|
|
||||||
|
agent {
|
||||||
|
enabled = true
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -22,7 +22,7 @@ variable "control_plane_count" {
|
||||||
variable "control_plane_cores" {
|
variable "control_plane_cores" {
|
||||||
description = "Number of CPU cores for control plane nodes"
|
description = "Number of CPU cores for control plane nodes"
|
||||||
type = number
|
type = number
|
||||||
default = 2
|
default = 4
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "control_plane_memory" {
|
variable "control_plane_memory" {
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue