diff --git a/CLAUDE.md b/CLAUDE.md index 4c313c2..244e63b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -161,12 +161,12 @@ tofu plan ## Recent Infrastructure Updates -### Talos Home Cluster (10.0.15.1-6) +### Talos Home Cluster (10.0.15.1-7) - **Purpose**: Primary home lab Kubernetes cluster - **Cluster Name**: home-cluster - **Kubernetes Version**: v1.36.1 - **Control Plane Nodes**: 3 (10.0.15.1-3) -- **Worker Nodes**: 4 (10.0.15.4-7, incl. bare-metal talos4) +- **Worker Nodes**: 4 (10.0.15.4-7) - **API Endpoint**: https://10.0.15.1:6443 - **Proxmox Cluster**: "home" (node1, node2, node3 at 10.0.15.101-103) - **VM Disks**: local-lvm on each Proxmox node @@ -182,14 +182,14 @@ tofu plan - `talosconfig` - Talosctl client config - `secrets.yaml` - Cluster secrets - `controlplane.yaml` / `worker.yaml` - Base node configs - - `configs/talos-worker{1,2,3}.yaml` - Per-node worker configs (with disk/extension settings) - - `configs/talos-cp{1,2,3}.yaml` - Per-node control plane configs + - `worker.yaml` / `controlplane.yaml` - Base node configs (applied with per-node patches) + - `patches/*.yaml` - Per-node patches (hostname, disk overrides) - **GitOps**: ArgoCD (replaced Flux on 2026-04-29). See `home/cluster/argocd/` and the GitOps section below. - **Applications**: deployed via ArgoCD `Application` manifests in `home/cluster/argocd/apps/` - - **APRS.me** (namespace `aprs`, https://aprs.me) — sourced from `git.mcintire.me/graham/aprs.me.git` `./k8s` - - **gridmap** (namespace `gridmap`) — sourced from `git.mcintire.me/graham/gridmap.git` `./k8s` - - **prop** (namespace `prop`) — sourced from `git.mcintire.me/graham/prop.git` `./k8s` - - **towerops** (namespace `towerops`) — sourced from `git.mcintire.me/graham/towerops-web.git` `./k8s` + - **APRS.me** (namespace `aprs`, https://aprs.me) — sourced from `codeberg.org/gmcintire/aprs.me.git` `./k8s` + - **gridmap** (namespace `gridmap`) — sourced from `codeberg.org/gmcintire/gridmap.git` `./k8s` + - **prop** (namespace `prop`) — sourced from `codeberg.org/gmcintire/prop.git` `./k8s` + - **towerops** (namespace `towerops`) — sourced from `codeberg.org/gmcintire/towerops-web.git` `./k8s` - **Documentation**: See `/talos/README.md` and `/cluster/README.md` for detailed operations - **Config Notes**: - `install.extraKernelArgs` and `install.grubUseUKICmdline` cannot be used together @@ -198,7 +198,7 @@ tofu plan ### GitOps via ArgoCD (home-cluster) - **Install**: `home/cluster/argocd/install/` — upstream ArgoCD manifests + a Kustomize patch enabling `server.insecure=true` (cloudflared terminates TLS) and `reposerver.git.modules.enabled=false` (the `aprs.me` repo has a stale submodule pin that breaks fetch otherwise) - **App-of-apps**: `home/cluster/argocd/root-app.yaml` watches `home/cluster/argocd/apps/` in this repo and reconciles all child Applications. Add a new YAML to `apps/` and push — Argo picks it up. -- **Repo creds**: `forgejo-mcintire-creds` Secret in `argocd` ns is a credential template for `https://git.mcintire.me/graham` — username/password copied from `flux-system/forgejo-git-credentials`. +- **Repo creds**: `forgejo-mcintire-creds` Secret in `argocd` ns is a credential template for `https://codeberg.org/gmcintire` — username/password copied from `flux-system/forgejo-git-credentials`. - **UI**: `argo.w5isp.com` via cloudflared tunnel → `argocd-server.argocd.svc.cluster.local:80`. Initial admin password is in `argocd/argocd-initial-admin-secret`. - **Image auto-update**: Flux's `ImagePolicy`/`ImageUpdateAutomation` is gone. Annotations like `# {"$imagepolicy": "flux-system:prop"}` in app repo manifests are inert. To restore, install `argocd-image-updater`. diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-380.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-380.conf index e69de29..d2ef5fa 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-380.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-380.conf @@ -0,0 +1,18 @@ +object Host "core-router" { + import "mikrotik" + address = "10.254.254.253" + vars.tower = "380" +} + +object Host "edge-router" { + import "mikrotik" + address = "10.254.254.254" + vars.tower = "380" +} + +object Host "380-climax-af24" { + import "af24" + address = "10.250.1.90" + vars.tower = "380" + vars.parents = "core-router" +} diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-494.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-494.conf index 479a408..c14868f 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-494.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-494.conf @@ -3,15 +3,17 @@ object Host "494-router" { address = "10.254.254.111" vars.tower = "494" } + object Host "494-omni-2.4" { import "ap-ubnt" address = "10.10.175.10" vars.tower = "494" - vars.parents = "10.254.254.111" + vars.parents = "494-router" } + object Host "494-omni-epmp" { import "ap-epmp" address = "10.10.175.11" vars.tower = "494" - vars.parents = "10.254.254.111" + vars.parents = "494-router" } diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-982.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-982.conf index d0486fc..f1c4183 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-982.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-982.conf @@ -10,39 +10,59 @@ object Host "982-1" { vars.tower = "982" vars.parents = "982-router" } + object Host "982-2" { import "ap-ubnt" address = "10.10.63.2" vars.tower = "982" vars.parents = "982-router" } + object Host "982-3" { import "ap-ubnt" address = "10.10.63.3" vars.tower = "982" vars.parents = "982-router" } + object Host "982-4" { import "ap-ubnt" address = "10.10.63.4" vars.tower = "982" vars.parents = "982-router" } + object Host "982-5" { import "ap-ubnt" address = "10.10.63.5" vars.tower = "982" vars.parents = "982-router" } + object Host "982-6" { import "ap-ubnt" address = "10.10.63.6" vars.tower = "982" vars.parents = "982-router" } -object Host "982-to-380" { + +object Host "982-t-380" { import "ap-ubnt" address = "10.250.1.34" vars.tower = "982" vars.parents = "982-router" } + +object Host "982-t-380" { + import "ap-ubnt" + address = "10.250.1.34" + vars.tower = "982" + vars.parents = "982-router" +} + +object Host "982-t- " { + import "ap-ubnt" + address = "" + vars.tower = "982" + vars.parents = "982-router" +} diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-climax.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-climax.conf index 322a5e5..4ccc050 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-climax.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-climax.conf @@ -8,48 +8,54 @@ object Host "climax-ubnt-nw" { import "ap-ubnt" address = "10.10.31.11" vars.tower = "Climax" - vars.parents = "10.254.254.102" + vars.parents = "climax-router" } + object Host "climax-ubnt-ne" { import "ap-ubnt" address = "10.10.31.12" vars.tower = "Climax" - vars.parents = "10.254.254.102" + vars.parents = "climax-router" } + object Host "climax-ubnt-s" { import "ap-ubnt" address = "10.10.31.13" vars.tower = "Climax" - vars.parents = "10.254.254.102" + vars.parents = "climax-router" } + object Host "climax-epmp-nw" { import "ap-epmp" address = "10.10.31.30" vars.tower = "Climax" - vars.parents = "10.254.254.102" + vars.parents = "climax-router" } + object Host "climax-900-w" { import "ap-ubnt" address = "10.10.31.40" vars.tower = "Climax" - vars.parents = "10.254.254.102" + vars.parents = "climax-router" } object Host "climax-core-af24" { import "af24" - address = "10.250.1.90" + address = "10.250.1.93" vars.tower = "Climax" - vars.parents = "10.254.254.102" + vars.parents = "climax-router" } + //object Host "climax-verona-af11" { // import "af11" // address = "10.250.1.29" // vars.tower = "Climax" -// vars.parents = "10.254.254.102" +// vars.parents = "climax-router" //} + //object Host "climax-culleoka-af11" { // import "af11" // address = "10.250.1.13" // vars.tower = "Climax" -// vars.parents = "10.254.254.102" +// vars.parents = "climax-router" //} diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-culleoka.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-culleoka.conf index 8477f04..bee5c82 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-culleoka.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-culleoka.conf @@ -8,14 +8,14 @@ object Host "culleoka-ubnt-ac1" { import "ap-ubnt" address = "10.10.111.1" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } object Host "culleoka-ubnt-ac2" { import "ap-ubnt" address = "10.10.111.2" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } //object Host "culleoka-ubnt-se" { @@ -23,56 +23,63 @@ object Host "culleoka-ubnt-ac2" { // address = "10.10.111.11" // vars.tower = "Culleoka" //} + object Host "culleoka-ubnt-sw" { import "ap-ubnt" address = "10.10.111.12" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } + object Host "culleoka-n" { import "ap-ubnt" address = "10.10.111.14" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } + object Host "culleoka-epmp-n" { import "ap-epmp" address = "10.10.111.30" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } + object Host "culleoka-epmp-se" { import "ap-epmp" address = "10.10.111.31" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } + object Host "culleoka-epmp-sw" { import "ap-epmp" address = "10.10.111.32" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } + object Host "culleoka-epmp-ne" { import "ap-epmp" address = "10.10.111.33" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } //object Host "culleoka-ac-power" { // import "generic-host" // address = "100.64.27.252" // vars.tower = "Culleoka" -// vars.parents = "10.254.254.104" +// vars.parents = "culleoka-router" //} //object Host "culleoka-climax-af11" { // import "af11" // address = "10.250.1.10" // vars.tower = "Culleoka" -// vars.parents = "10.254.254.104" +// vars.parents = "culleoka-router" //} + //object Host "clayton-ap" { // import "ap-ubnt" // address = "10.10.111.50" @@ -83,5 +90,5 @@ object Host "culleoka-clayton-bh" { import "ap-ubnt" address = "10.10.111.61" vars.tower = "Culleoka" - vars.parents = "10.254.254.104" + vars.parents = "culleoka-router" } diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-lowrycrossing.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-lowrycrossing.conf index 4adedb6..c512034 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-lowrycrossing.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-lowrycrossing.conf @@ -8,26 +8,26 @@ object Host "lowrycrossing-omni" { import "ap-epmp" address = "10.10.159.10" vars.tower = "Lowry Crossing" - vars.parents = "10.254.254.109" + vars.parents = "lowrycrossing-router" } object Host "lowrycrossing-ne" { import "ap-epmp" address = "10.10.159.11" vars.tower = "Lowry Crossing" - vars.parents = "10.254.254.109" + vars.parents = "lowrycrossing-router" } object Host "lowrycrossing-n" { import "ap-epmp" address = "10.10.159.10" vars.tower = "Lowry Crossing" - vars.parents = "10.254.254.109" + vars.parents = "lowrycrossing-router" } object Host "lowrycrossing-newhope-af24" { import "af24" address = "10.250.1.106" vars.tower = "Lowry Crossing" - vars.parents = "10.254.254.109" + vars.parents = "lowrycrossing-router" } diff --git a/ansible/roles/monitor/files/icinga2/conf.d/hosts-verona.conf b/ansible/roles/monitor/files/icinga2/conf.d/hosts-verona.conf index 7ea2413..ccc465b 100644 --- a/ansible/roles/monitor/files/icinga2/conf.d/hosts-verona.conf +++ b/ansible/roles/monitor/files/icinga2/conf.d/hosts-verona.conf @@ -4,39 +4,43 @@ object Host "verona-router" { vars.tower = "Verona" } -//object Host "verona-nw" { -// import "ap-ubnt" -// address = "10.10.15.11" -// vars.tower = "Verona" -// vars.parents = "10.254.254.101" -//} -//object Host "verona-ne" { -// import "ap-ubnt" -// address = "10.10.15.12" -// vars.tower = "Verona" -// vars.parents = "10.254.254.101" -//} -//object Host "verona-s" { -// import "ap-ubnt" -// address = "10.10.15.13" -// vars.tower = "Verona" -// vars.parents = "10.254.254.101" -//} +object Host "verona-nw" { + import "ap-ubnt" + address = "10.10.15.11" + vars.tower = "Verona" + vars.parents = "verona-router" +} + +object Host "verona-ne" { + import "ap-ubnt" + address = "10.10.15.12" + vars.tower = "Verona" + vars.parents = "verona-router" +} + +object Host "verona-s" { + import "ap-ubnt" + address = "10.10.15.13" + vars.tower = "Verona" + vars.parents = "verona-router" +} + //object Host "verona-switch" { // import "netonix" // address = "100.64.3.250" // vars.tower = "Verona" -// vars.parents = "10.254.254.101" +// vars.parents = "verona-router" //} + object Host "verona-climax-af11" { import "af11" address = "10.250.1.26" vars.tower = "Verona" - vars.parents = "10.254.254.101" + vars.parents = "verona-router" } + //object Host "verona-altoga" { // import "ap-ubnt" // address = "10.250.1.146" // vars.tower = "Verona" //} - diff --git a/home/cluster/aprs/deploy.sh b/home/cluster/aprs/deploy.sh index 595d357..c8a4953 100644 --- a/home/cluster/aprs/deploy.sh +++ b/home/cluster/aprs/deploy.sh @@ -10,16 +10,7 @@ kubectl config use-context admin@home echo "Creating namespace..." kubectl apply -f namespace.yaml --validate=false -# Deploy PostgreSQL with PostGIS -echo "Deploying PostgreSQL 17 with PostGIS..." -kubectl apply -f postgres-secret-secure.yaml --validate=false -kubectl apply -f postgres-deployment.yaml --validate=false - -# Wait for PostgreSQL to be ready -echo "Waiting for PostgreSQL to be ready..." -kubectl wait --for=condition=ready pod -l app=postgres-aprs -n aprs --timeout=300s - -# Deploy APRS.me +# Deploy APRS.me (database is on dedicated host) echo "Deploying APRS.me application..." kubectl apply -f aprs-secret-secure.yaml --validate=false kubectl apply -f aprs-configmap.yaml --validate=false diff --git a/home/cluster/aprs/install-postgis-manual.sh b/home/cluster/aprs/install-postgis-manual.sh deleted file mode 100644 index 1979d4c..0000000 --- a/home/cluster/aprs/install-postgis-manual.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash -# Manual commands to install PostGIS on the PostgreSQL LXC container - -echo "Run these commands on the Proxmox host:" -echo "" -echo "# 1. Update package list in the container" -echo "pct exec 300 -- apt-get update" -echo "" -echo "# 2. Install PostGIS for PostgreSQL 15" -echo "pct exec 300 -- apt-get install -y postgresql-15-postgis-3" -echo "" -echo "# 3. Enable PostGIS extension in the APRS database" -echo "pct exec 300 -- sudo -u postgres psql -d aprs -c 'CREATE EXTENSION IF NOT EXISTS postgis;'" -echo "" -echo "# 4. Verify installation" -echo "pct exec 300 -- sudo -u postgres psql -d aprs -c 'SELECT PostGIS_Version();'" -echo "" -echo "After running these commands, the APRS migrations should work." \ No newline at end of file diff --git a/home/cluster/aprs/postgres-deployment-normal.yaml b/home/cluster/aprs/postgres-deployment-normal.yaml deleted file mode 100644 index 1e6042d..0000000 --- a/home/cluster/aprs/postgres-deployment-normal.yaml +++ /dev/null @@ -1,74 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: postgres-aprs - namespace: aprs -spec: - selector: - app: postgres-aprs - ports: - - port: 5432 - targetPort: 5432 - clusterIP: None ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: postgres-aprs - namespace: aprs -spec: - serviceName: postgres-aprs - replicas: 1 - selector: - matchLabels: - app: postgres-aprs - template: - metadata: - labels: - app: postgres-aprs - spec: - terminationGracePeriodSeconds: 600 # 10 minutes to shutdown gracefully - containers: - - name: postgres - image: postgis/postgis:17-3.4 - ports: - - containerPort: 5432 - envFrom: - - secretRef: - name: postgres-aprs-secret - env: - - name: PGDATA - value: /var/lib/postgresql/data/pgdata - volumeMounts: - - name: postgres-storage - mountPath: /var/lib/postgresql/data - livenessProbe: - exec: - command: - - /bin/sh - - -c - - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB - initialDelaySeconds: 300 # 5 minutes to start - periodSeconds: 30 # Check every 30s - timeoutSeconds: 10 # 10s timeout for probe - failureThreshold: 20 # Allow 20 failures (10 minutes) - readinessProbe: - exec: - command: - - /bin/sh - - -c - - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB - initialDelaySeconds: 300 # 5 minutes to start - periodSeconds: 30 # Check every 30s - timeoutSeconds: 10 # 10s timeout for probe - failureThreshold: 20 # Allow 20 failures (10 minutes) - volumeClaimTemplates: - - metadata: - name: postgres-storage - spec: - accessModes: ["ReadWriteOnce"] - storageClassName: longhorn - resources: - requests: - storage: 100Gi \ No newline at end of file diff --git a/home/cluster/aprs/postgres-deployment-repair.yaml b/home/cluster/aprs/postgres-deployment-repair.yaml deleted file mode 100644 index aed8c1a..0000000 --- a/home/cluster/aprs/postgres-deployment-repair.yaml +++ /dev/null @@ -1,55 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: postgres-aprs - namespace: aprs -spec: - selector: - app: postgres-aprs - ports: - - port: 5432 - targetPort: 5432 - clusterIP: None ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: postgres-aprs - namespace: aprs -spec: - serviceName: postgres-aprs - replicas: 1 - selector: - matchLabels: - app: postgres-aprs - template: - metadata: - labels: - app: postgres-aprs - spec: - terminationGracePeriodSeconds: 3600 # 1 hour to shutdown gracefully - containers: - - name: postgres - image: postgis/postgis:17-3.4 - ports: - - containerPort: 5432 - envFrom: - - secretRef: - name: postgres-aprs-secret - env: - - name: PGDATA - value: /var/lib/postgresql/data/pgdata - volumeMounts: - - name: postgres-storage - mountPath: /var/lib/postgresql/data - # NO HEALTH CHECKS - Pod will run indefinitely even if unhealthy - volumeClaimTemplates: - - metadata: - name: postgres-storage - spec: - accessModes: ["ReadWriteOnce"] - storageClassName: longhorn - resources: - requests: - storage: 100Gi \ No newline at end of file diff --git a/home/cluster/aprs/postgres-deployment.yaml b/home/cluster/aprs/postgres-deployment.yaml deleted file mode 100644 index ecb6134..0000000 --- a/home/cluster/aprs/postgres-deployment.yaml +++ /dev/null @@ -1,87 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: postgres-aprs - namespace: aprs -spec: - selector: - app: postgres-aprs - ports: - - port: 5432 - targetPort: 5432 - type: ClusterIP ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: postgres-aprs - namespace: aprs -spec: - serviceName: postgres-aprs - replicas: 1 - selector: - matchLabels: - app: postgres-aprs - template: - metadata: - labels: - app: postgres-aprs - spec: - terminationGracePeriodSeconds: 600 # 10 minutes to shutdown gracefully - securityContext: - fsGroup: 999 - fsGroupChangePolicy: OnRootMismatch - containers: - - name: postgres - image: postgis/postgis:17-3.4 - ports: - - containerPort: 5432 - envFrom: - - secretRef: - name: postgres-aprs-secret - env: - - name: PGDATA - value: /var/lib/postgresql/data/pgdata - volumeMounts: - - name: postgres-storage - mountPath: /var/lib/postgresql/data - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - runAsUser: 999 - runAsGroup: 999 - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - livenessProbe: - exec: - command: - - /bin/sh - - -c - - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB - initialDelaySeconds: 60 # 1 minute to start - periodSeconds: 30 # Check every 30s - timeoutSeconds: 10 # 10s timeout for probe - failureThreshold: 3 # Allow 3 failures - readinessProbe: - exec: - command: - - /bin/sh - - -c - - pg_isready -U $POSTGRES_USER -d $POSTGRES_DB - initialDelaySeconds: 30 # 30 seconds to start - periodSeconds: 10 # Check every 10s - timeoutSeconds: 5 # 5s timeout for probe - failureThreshold: 3 # Allow 3 failures - volumeClaimTemplates: - - metadata: - name: postgres-storage - spec: - accessModes: ["ReadWriteOnce"] - storageClassName: longhorn - resources: - requests: - storage: 256Gi \ No newline at end of file diff --git a/home/cluster/aprs/postgres-normal-mode.sh b/home/cluster/aprs/postgres-normal-mode.sh deleted file mode 100644 index 26b3b15..0000000 --- a/home/cluster/aprs/postgres-normal-mode.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -# Restore normal mode for PostgreSQL (with health checks) - -echo "Restoring PostgreSQL normal mode (with health checks)..." -export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig - -kubectl apply -f postgres-deployment-normal.yaml - -echo "PostgreSQL is now in normal mode with health checks enabled" -echo "Monitor with: kubectl logs -n aprs postgres-aprs-0 -f" \ No newline at end of file diff --git a/home/cluster/aprs/postgres-repair-mode.sh b/home/cluster/aprs/postgres-repair-mode.sh deleted file mode 100644 index cf220c1..0000000 --- a/home/cluster/aprs/postgres-repair-mode.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash -# Enable repair mode for PostgreSQL (no health checks) - -echo "Enabling PostgreSQL repair mode (no health checks)..." -export KUBECONFIG=/Users/graham/dev/infra/home/ansible/kubeconfig - -kubectl apply -f postgres-deployment-repair.yaml - -echo "PostgreSQL is now in repair mode - it will run indefinitely without health checks" -echo "Monitor with: kubectl logs -n aprs postgres-aprs-0 -f" -echo "To restore normal mode, run: ./postgres-normal-mode.sh" \ No newline at end of file diff --git a/home/cluster/aprs/postgres-secret-secure.yaml b/home/cluster/aprs/postgres-secret-secure.yaml deleted file mode 100644 index 5338bed..0000000 --- a/home/cluster/aprs/postgres-secret-secure.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: v1 -kind: Secret -metadata: - name: postgres-aprs-secret - namespace: aprs -type: Opaque -stringData: - POSTGRES_DB: aprsdb - POSTGRES_USER: aprs - POSTGRES_PASSWORD: "17fZZOsYeeBCf0GN8olKaKrYCsUca25V" - POSTGRES_REPLICATION_MODE: master - POSTGRES_REPLICATION_USER: replicator - POSTGRES_REPLICATION_PASSWORD: "qVXVmSA3HOVgn6zLY3TrhvUHxmPUMhc0" \ No newline at end of file diff --git a/home/cluster/argocd/image-updater/kustomization.yaml b/home/cluster/argocd/image-updater/kustomization.yaml index c87bc81..4d3106a 100644 --- a/home/cluster/argocd/image-updater/kustomization.yaml +++ b/home/cluster/argocd/image-updater/kustomization.yaml @@ -18,9 +18,9 @@ patches: data: registries.conf: | registries: - - name: Forgejo Registry - api_url: https://git.mcintire.me - prefix: git.mcintire.me + - name: Codeberg Registry + api_url: https://codeberg.org + prefix: codeberg.org ping: yes credentials: pullsecret:argocd/forgejo-registry default: true diff --git a/home/cluster/argocd/root-app.yaml b/home/cluster/argocd/root-app.yaml index 1387fbd..40a444a 100644 --- a/home/cluster/argocd/root-app.yaml +++ b/home/cluster/argocd/root-app.yaml @@ -8,7 +8,7 @@ metadata: spec: project: default source: - repoURL: https://git.mcintire.me/graham/infra.git + repoURL: https://codeberg.org/gmcintire/infra.git targetRevision: main path: home/cluster/argocd/apps directory: diff --git a/talos/CLAUDE.md b/talos/CLAUDE.md index 9dcd169..340c9bf 100644 --- a/talos/CLAUDE.md +++ b/talos/CLAUDE.md @@ -40,92 +40,45 @@ cd /Users/graham/dev/infra/talos talosctl gen secrets -o secrets.yaml --force ``` -### 2. Generate Node-Specific Configurations +### 2. Generate Base Configurations -Each node needs a configuration with its specific hostname. Use patch files to set hostnames: +Generate the base control plane and worker configs. Per-node settings (hostname, disk) are applied via `--config-patch` at deploy time, not baked into the configs. ```bash -mkdir -p configs +# Generate base control plane config (used for all CP nodes with per-node patches) +talosctl gen config home-cluster https://10.0.15.1:6443 \ + --with-secrets secrets.yaml \ + --kubernetes-version v1.36.1 \ + --output-types controlplane \ + --output controlplane.yaml -# Generate control plane configs -for i in 1 2 3; do - cat > /tmp/cp${i}-patch.yaml < /tmp/w${i}-patch.yaml < /dev/null 2>&1 && echo "up" || echo "down" +done ``` -### 7. Bootstrap the Cluster +### 6. Bootstrap the Cluster (after configs are applied per step 3) ```bash # Set talosctl endpoints @@ -227,8 +182,9 @@ kubectl get nodes - `secrets.yaml` - Cluster secrets (CRITICAL - keep secure and backed up!) - `talosconfig` - Talosctl client configuration -- `configs/talos-cp*.yaml` - Control plane node configurations -- `configs/talos-worker*.yaml` - Worker node configurations +- `controlplane.yaml` / `worker.yaml` - Base node configs (with cluster secrets) +- `patches/cp*.yaml` - Per-node control plane patches (hostname only) +- `patches/worker*.yaml` - Per-node worker patches (hostname, disk) - `~/.kube/config` - Contains merged kubeconfig with admin@home-cluster context ## Key Lessons Learned @@ -252,10 +208,10 @@ kubectl get nodes ssh root@ "qm set --cpu host --balloon 0 --numa 0 --sockets 1 --net0 virtio=,bridge=vmbr0,firewall=0 --onboot 1 --agent enabled=1,fstrim_cloned_disks=0,type=virtio --vga std,memory=16" ssh root@ "qm resize scsi0 64G" ssh root@ "qm start " - # Wait for DHCP, then apply config: - talosctl --talosconfig talosconfig apply-config --nodes --file configs/.yaml --insecure - # Then upgrade to the factory image with extensions (iscsi-tools, util-linux-tools): - talosctl --talosconfig talosconfig --nodes upgrade --image factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.13.3 + # Wait for DHCP, then apply config with the per-node patch: + talosctl --talosconfig talosconfig apply-config --nodes --file worker.yaml --config-patch @patches/worker.yaml --insecure + # Worker VMs use the factory image (with iscsi-tools, util-linux-tools) by default, + # so no upgrade step is needed. Control plane nodes use the stock installer. ``` **Critical VM settings**: `cpu: host` is required — without it, Talos boots but never gets a network address. Also set `balloon: 0`, `firewall=0` on NIC. @@ -301,8 +257,8 @@ talosctl --talosconfig talosconfig service --nodes 10.0.15.1 1. Add VM definition to `terraform/talos_vms.tf` 2. Run `tofu apply` -3. Generate config with appropriate hostname -4. Apply config: `talosctl apply-config --nodes --file .yaml --insecure` +3. Create a per-node patch in `patches/` with the appropriate hostname +4. Apply config with patch: `talosctl --talosconfig talosconfig apply-config --nodes --file worker.yaml --config-patch @patches/.yaml --insecure` ### Upgrading Talos @@ -321,7 +277,8 @@ talosctl --talosconfig talosconfig upgrade-k8s --to 1.36.1 Essential files to backup: 1. `secrets.yaml` - Cannot recover cluster without this 2. `talosconfig` - Required for talosctl access -3. Node configs in `configs/` directory -4. Terraform state (stored in GitLab HTTP backend) +3. `controlplane.yaml` / `worker.yaml` - Base node configs +4. Patch files in `patches/` directory +5. Terraform state (stored in GitLab HTTP backend) Store securely in password manager or encrypted backup location. diff --git a/talos/README.md b/talos/README.md index 3a75e27..3e5e429 100644 --- a/talos/README.md +++ b/talos/README.md @@ -24,8 +24,9 @@ ## Configuration Files - `secrets.yaml` - Cluster secrets (keep secure!) -- `controlplane.yaml` - Control plane node configuration -- `worker.yaml` - Worker node configuration +- `controlplane.yaml` - Base control plane config (applied with per-node patches) +- `worker.yaml` - Base worker config (applied with per-node patches) +- `patches/*.yaml` - Per-node patches (hostname, disk overrides) - `talosconfig` - Talosctl client configuration ## Using the Cluster @@ -79,9 +80,10 @@ VM boot disks are stored on local-lvm on each Proxmox node (no shared Ceph stora ### Adding a Node 1. Clone VM from template in Terraform -2. Apply appropriate config: +2. Create a per-node patch in `patches/` with the hostname +3. Apply base config with patch: ```bash - talosctl --talosconfig talosconfig apply-config --insecure --nodes --file controlplane.yaml + talosctl --talosconfig talosconfig apply-config --insecure --nodes --file worker.yaml --config-patch @patches/.yaml ``` ### Removing a Node @@ -132,7 +134,8 @@ talosctl --talosconfig talosconfig reboot --nodes Important files to backup: - `secrets.yaml` - Required to add nodes or recover cluster - `talosconfig` - Required for talosctl access -- Node configs in `configs/` directory +- `controlplane.yaml` and `worker.yaml` - Base node configs +- `patches/` directory - Per-node patches - Kubeconfig is stored in `~/.kube/config` Store these securely in a password manager or encrypted backup. diff --git a/talos/configs/talos-cp1.yaml b/talos/configs/talos-cp1.yaml deleted file mode 100644 index 792dbab..0000000 --- a/talos/configs/talos-cp1.yaml +++ /dev/null @@ -1,407 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: controlplane # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. - # type: bind # Type specifies the mount kind. - # source: /var/lib/example # Source specifies the source path of the mount. - # # Options are fstab style mount options. - # options: - # - bind - # - rshared - # - rw - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.13.3 # Allows for supplying the image used to perform the installation. - - wipe: false # Indicates if the installation disk should be wiped at installation time. - grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - # Configures the node labels for the machine. - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded private key for service account token generation. - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - # API server specific configuration options. - apiServer: - image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # Configure the API server admission plugins. - admissionControl: - - name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - # Configure the API server audit policy. - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - # Controller manager server specific configuration options. - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # Kube-proxy server-specific configuration options - proxy: - image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - - # # Disable kube-proxy deployment on cluster bootstrap. - # disabled: false - # Scheduler server specific configuration options. - scheduler: - image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - # Etcd specific configuration options. - etcd: - # The `ca` is the root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - - # # The container image used to create the etcd service. - # image: registry.k8s.io/etcd:v3.6.7 - - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - # A list of urls that point to additional manifests. - extraManifests: [] - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # A list of inline Kubernetes manifests. - inlineManifests: [] - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos-cp1 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-cp2.yaml b/talos/configs/talos-cp2.yaml deleted file mode 100644 index 6e502a4..0000000 --- a/talos/configs/talos-cp2.yaml +++ /dev/null @@ -1,407 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: controlplane # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. - # type: bind # Type specifies the mount kind. - # source: /var/lib/example # Source specifies the source path of the mount. - # # Options are fstab style mount options. - # options: - # - bind - # - rshared - # - rw - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.13.3 # Allows for supplying the image used to perform the installation. - - wipe: false # Indicates if the installation disk should be wiped at installation time. - grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - # Configures the node labels for the machine. - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded private key for service account token generation. - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - # API server specific configuration options. - apiServer: - image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # Configure the API server admission plugins. - admissionControl: - - name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - # Configure the API server audit policy. - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - # Controller manager server specific configuration options. - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # Kube-proxy server-specific configuration options - proxy: - image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - - # # Disable kube-proxy deployment on cluster bootstrap. - # disabled: false - # Scheduler server specific configuration options. - scheduler: - image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - # Etcd specific configuration options. - etcd: - # The `ca` is the root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - - # # The container image used to create the etcd service. - # image: registry.k8s.io/etcd:v3.6.7 - - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - # A list of urls that point to additional manifests. - extraManifests: [] - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # A list of inline Kubernetes manifests. - inlineManifests: [] - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos-cp2 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-cp3.yaml b/talos/configs/talos-cp3.yaml deleted file mode 100644 index f301d02..0000000 --- a/talos/configs/talos-cp3.yaml +++ /dev/null @@ -1,407 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: controlplane # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. - # type: bind # Type specifies the mount kind. - # source: /var/lib/example # Source specifies the source path of the mount. - # # Options are fstab style mount options. - # options: - # - bind - # - rshared - # - rw - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.13.3 # Allows for supplying the image used to perform the installation. - - wipe: false # Indicates if the installation disk should be wiped at installation time. - grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - # Configures the node labels for the machine. - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded private key for service account token generation. - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - # API server specific configuration options. - apiServer: - image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # Configure the API server admission plugins. - admissionControl: - - name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - # Configure the API server audit policy. - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - # Controller manager server specific configuration options. - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # Kube-proxy server-specific configuration options - proxy: - image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - - # # Disable kube-proxy deployment on cluster bootstrap. - # disabled: false - # Scheduler server specific configuration options. - scheduler: - image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - # Etcd specific configuration options. - etcd: - # The `ca` is the root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - - # # The container image used to create the etcd service. - # image: registry.k8s.io/etcd:v3.6.7 - - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - # A list of urls that point to additional manifests. - extraManifests: [] - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # A list of inline Kubernetes manifests. - inlineManifests: [] - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos-cp3 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker1.yaml b/talos/configs/talos-worker1.yaml deleted file mode 100644 index 75c1943..0000000 --- a/talos/configs/talos-worker1.yaml +++ /dev/null @@ -1,430 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: worker # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - registries: {} - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos-worker1 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker2.yaml b/talos/configs/talos-worker2.yaml deleted file mode 100644 index 8648a5b..0000000 --- a/talos/configs/talos-worker2.yaml +++ /dev/null @@ -1,430 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: worker # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - registries: {} - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos-worker2 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker3.yaml b/talos/configs/talos-worker3.yaml deleted file mode 100644 index 33fabea..0000000 --- a/talos/configs/talos-worker3.yaml +++ /dev/null @@ -1,430 +0,0 @@ -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: worker # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sda # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - registries: {} - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos-worker3 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker4.yaml b/talos/configs/talos-worker4.yaml deleted file mode 100644 index 4435220..0000000 --- a/talos/configs/talos-worker4.yaml +++ /dev/null @@ -1,433 +0,0 @@ -# Purpose: Bare-metal worker node (talos4, HP t620, 10.0.15.7) -# Disk: /dev/sdb (USB boot, internal drive after install) -# Installer: factory image with iscsi-tools + util-linux-tools extensions -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: worker # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/sdb # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - registries: {} - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos4 -# hostname: controlplane1.example.org diff --git a/talos/configs/talos-worker5.yaml b/talos/configs/talos-worker5.yaml deleted file mode 100644 index 3fe6e68..0000000 --- a/talos/configs/talos-worker5.yaml +++ /dev/null @@ -1,433 +0,0 @@ -# Purpose: Future worker node (talos5, bare-metal, 10.0.15.8 planned) -# Disk: /dev/nvme0n1 (NVMe internal drive) -# Installer: factory image with iscsi-tools + util-linux-tools extensions -version: v1alpha1 # Indicates the schema used to decode the contents. -debug: false # Enable verbose logging to the console. -persist: true -# Provides machine specific configuration options. -machine: - type: worker # Defines the role of the machine within the cluster. - token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Extra certificate subject alternative names for the machine's certificate. - certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - - # Used to provide additional options to the kubelet. - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. - defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. - disableManifestsDirectory: true # Disable static pod manifest directory. - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. - network: - nameservers: - - 9.9.9.9 - - 149.112.112.112 - - 1.1.1.1 - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. - install: - disk: /dev/nvme0n1 # The disk used for installations. - image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6 # Talos installer (factory image with storage extensions). - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - registries: {} - # Features describe individual Talos features that can be switched on or off. - features: - diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute - kubePrism: - enabled: true # Enable KubePrism support - will start local load balancing proxy. - port: 7445 # KubePrism port. - # Configures host DNS caching resolver. - hostDNS: - enabled: true # Enable host DNS caching resolver. - forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # Configures the machine's time settings. - time: - servers: - - 0.us.pool.ntp.org - - 1.us.pool.ntp.org - - 2.us.pool.ntp.org - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. -cluster: - id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). - secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. - controlPlane: - endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. - network: - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 - - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml - token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: "" - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: - disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. - service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true ---- -apiVersion: v1alpha1 -kind: HostnameConfig -hostname: talos5 -# hostname: controlplane1.example.org diff --git a/talos/controlplane.yaml b/talos/controlplane.yaml index 7c425ff..986af45 100644 --- a/talos/controlplane.yaml +++ b/talos/controlplane.yaml @@ -1,271 +1,70 @@ version: v1alpha1 # Indicates the schema used to decode the contents. debug: false # Enable verbose logging to the console. persist: true -# Provides machine specific configuration options. machine: type: controlplane # Defines the role of the machine within the cluster. token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSnl6amhYUVYzdE90b2tuSGFsYnN5WDJBeUJ5Z0ZraVpUb0E3dWFBMGwzQwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K - # Extra certificate subject alternative names for the machine's certificate. certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - # Used to provide additional options to the kubelet. kubelet: image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. disableManifestsDirectory: true # Disable static pod manifest directory. - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container. - # type: bind # Type specifies the mount kind. - # source: /var/lib/example # Source specifies the source path of the mount. - # # Options are fstab style mount options. - # options: - # - bind - # - rshared - # - rw - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. network: nameservers: - 9.9.9.9 - 149.112.112.112 - 1.1.1.1 - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. image: ghcr.io/siderolabs/installer:v1.13.3 # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - # Features describe individual Talos features that can be switched on or off. features: diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute kubePrism: enabled: true # Enable KubePrism support - will start local load balancing proxy. port: 7445 # KubePrism port. - # Configures host DNS caching resolver. hostDNS: enabled: true # Enable host DNS caching resolver. forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - # Configures the node labels for the machine. nodeLabels: node.kubernetes.io/exclude-from-external-load-balancers: "" - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. cluster: id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. controlPlane: endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. network: dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 - # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. secretboxEncryptionSecret: /6DYtkG9wQCrsXkbEX/FHsHyV0QfWG+E8wUCkpx9BNs= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - # The base64 encoded root certificate authority used by Kubernetes. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUw1QXpROEFBaU5vcTl1cHBTem5FRkNJMGFBaUNDMVVya3gvbDhBTU5wOTNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFME5TVDhvcjUvZDdBQmlCMGt0Z094SUFOdXU3eU55VmFmNU5YejJhakJjMytNbnc2YVRBLwphWitodzJDN3lmZHBOeFJRNFdzYnoraDBPRUFGTUVKeTZ3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. aggregatorCA: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFXZ0F3SUJBZ0lRVU9sVTh1M0QxT0NaeXRaYmxOWmRHREFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ERXhOREUzTlRJeU1sb1hEVE0yTURFeE1qRTNOVEl5TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCTDZxSEptN1FOSmFQQ2dIWS85NldoUjczSDVmaGJuZkpjd2p6bGI0VkdmaGlhUkV0UGl2Cm1wRFF5VzdIYlNLQlFpTXB3OVFDR3VZYk14MERpRlFTNUpXallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVaTVpMb1dlVHl6WUVrR29HMnNId2hJcEZybzR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loCkFLV09hWWxBbDU1dk1pN1ora29mWXRKZExjTnZqYUlLdjVYN0Nxb0txVUZEQWlFQTFjTmVuTzZSNzJPdndaSFQKOW9BcEZYcVBGRVlzZmpIU1ZvMVBjK3ZvckV3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5oUXdjWEZLNE9Sc0NKTjJOdGtwdkJ6bURleXlRbnB5cmk4UEhldGQ5a3pvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFdnFvY21idEEwbG84S0Fkai8zcGFGSHZjZmwrRnVkOGx6Q1BPVnZoVVorR0pwRVMwK0srYQprTkRKYnNkdElvRkNJeW5EMUFJYTVoc3pIUU9JVkJMa2xRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # The base64 encoded private key for service account token generation. serviceAccount: key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS0FJQkFBS0NBZ0VBdnZZT0I5WnFWQ3dJaCtkenBTbXN6Yk0xUzJGYldyTVF4RzlSZFA3TGpYcTZJYmhJCmhpc09vRDJOOUxJeXk4MWVpQ1IvMlhrMGF0L2VyWHA5a2VqNHRNbTNrSkpKMVRZL3Q1ZVlxTldCeDNEN2Q5ekMKOVZxZDl3N1VEMmxwWHA0QmhtdUh1Tno5ZXRUMjYwTTJlMjVzWlIvTlRGYU9ZVDI1QmNJOHZjVGhoV0VYbHVFQgpTbithSWQrcHJvSmx4WEg3bHBZaS83TFYyVGV1SWdXbVVabUtOOGZ2aTdxb3RqNmRCWTVKWHFvOENhaVFzdHdvCjhsMGhEdmowZS8zaitUY1F4U3lzS1l4UXZwMWhPaVM4VFN3bm10Z3hSUWUwVHlxM0FHU3Jhc0t3L3NnSDRzSU8KRDl4SkN1UFZ4T01wYlBDaW4zdk43eHhxRno3ZEhETTQ2cEprRU1tcy8yTkwxRmlHK0ZZLzc2TnpjMldrZ0ZkLworcW4xZkN1RGh0R2NUUklwY1pBQnhuTzg4NWtvM1dBNDdKTTI1TE1IcGprSktmNG5XVnBoZW9OL0ZlVG9Gb3IyCjErSU5GcGxBTlNvT0NBTFhNZ2E4MTlENHdZYWRGRkVqcXRBVXVERG91eHJ1RFJmVi9XZ1N0YTRNczlraUdGeXkKczNnYUg1bHFrQm5SSFVaMW1hTWhUTlA3RlNheVpUNFkwLzJIQkc4YWN1eFRyVGhKRndwSVhxckwvV1Y3QUhmZApZb0Q4NHJTK1JZeGJmODlnOU5UQ1JrWU9COUFWTXhoZDQrbGQvaW1iQi9rR2ZEc1dkV014Mldxa2did3dQbUEzClhySGp1MnExL29XZXJTbVdpRUgwWGwwYmVocmJxUy9keHJHdW5vYXhnZHJJRDMrTVZKa1AwUzR4NkNzQ0F3RUEKQVFLQ0FnQUJvTG9BanhvR1JhblNTVzE1bkVxcmU0K2FFNUVOSU9HbEN3aU5aVzZrSE1aaGF6Uzl1cmc3M1hVaApxak0zVVlvd3daUTZ3bHhwWE5IYWRnK0QrRHh4TGhjR2dIaTkvSXhtZ0VCVGtCNWZHTjRoUGh5R0F1a1RKaFBnCnN4YXNNU1NmaExoNklaMTNqVUV5N1l2QUJFZWdSUTUyOXN0Q2xrZ2NLSFVPdzcyTnZ0b2pTeCs3c1lMRmhIdnAKejVWcjJDRG1QbVFRcDBielp4VEdRczRSZkFHVm9DVmI4ank3UmxBSVdzSW9CY042bHU2YUxRNUc5L2J1MkdoeQpkaU9hQ0VJakFYMG1PQy85V3FkdGhoLzZJeG80cVFjaWZpejhwUnlTUUVsd2RqVyt0a01sblFuZSsyaHBVMXFMCkp4OC9SOU13Wmk4Y2pyTEkwcHhkUDlmZHNyUnZweFhpR0Q5NHRMdUFHUE85VnRiTUZRKzJUUnZXdGE5ays0ZDAKUTFZN3pJQnBHd2NVUlBnZnpSVFVHTWo4SXFleTFveUZUcmErZlBOeml6bmlDTlM5NlRQMUJJWDJoSy9mSDBKVgo4UEU2Lzl0MUNyNDc2WWtJakd0c2JCNTVheHd3bGtwMWpha3g4MUlNd0FqbFU5aVV4UXNNUFRLbGFBWis0NW5oCnBoMUdURjRaMDdYR0lwK3BsMkpubldrSUNpSnVEQUMxTmRydVFRU3pDZUwwd0k1ZW5oaHI1REdXZ2JzTDZoWmMKbVJFQ1pRWjBLdlBQelhQSnc1MWZzZ01wN2RLRFdiYzZzM25ocWxGL0xlckhjRXV5Q1ZwRzAxSU1Tb0l0TWkwSgpPZ2g4VVl6K2NzbmpmVng0WXlKMzF0K254L0RBRUN2bEVDYjY3Z3Fjd212M3dhaS9ZUUtDQVFFQTd1ZWM2cEdFCloyMWpLbGRMOHBQTGVCcHlQWHhZKzFVWG4zanVyWUVsTk5NbnY1Vk1MWEFmd1hBUFVVQmVvZ2JHejdjQVgxU1oKMVdmdFFHSDJod1lWYS9ZVUNKZGNORi90VWNiK2FHdVlqblQwZy9yNE04T2p6WDlaNHRlcUNza2dvdnJRN2ZiQgpVbFhieDZEYUc4ZzI2RVFGRmM0cWtDWnBBOGhqSU5QOHFKRm9MSFJlaWM2U3RKa3gySVFYTjJtRlNJY0svSkNmCm1rNUlDM0dJRFRwdmFyWGNZZGwzUDQ2TmVCNUhST09ZSDlnU1UxUjVFY0JyeE5zWWZqekx6TTFxNFZQVGRDeTYKQURQbVc0a1JjOE84S0kvdnhvV2ZFMTYvRmVtNDRaYm5IdkVHVmF4eG1vL3RwaGo3TW13QnBjU0xLbTk1alJRNwpOZCt1dU55eTFkbTFGUUtDQVFFQXpLQXZaUkhiSnNWL2xIWHlqQ2NHRlZqYm9BOVN4MUxNUzdCRHhOOFFuYk1JCkZmMmFCZmVNYXEzZzN0R2tHak1aTVRQL1oyMi85SWx0N2ZiK3hXOHhFZzVSdDJKZHY0V0kvWHp3MHg4YUI3blAKSXlwYkl6QiswRmliZXdXbG5xMTh3YkJHL1VXdDV4cXRNbE5McHNiMGp6SE5nMGVLdko0UURHdldOekRmR2J5eQpLVU9ib0J2cUkwaTBaZVZWU2kxTWkvVTN0M3k5bWk2M05FMWhoL25Nc29FRjNiMEhyRUJkNGNTa3VqVHh3RURhCmg0eFBYOTdGUU1ieDhxSUptM0labDc3RUZNWkxtODIxeWtablBpWDNNbFpNQ1JwblloK3kyakMvQ29CSDI1eFgKM1hhSmc2SDI4b2tiV2U4R20wQTQwWlhJSVJUSTBuQVpmT05OM2VyNFB3S0NBUUFGUXA1RzMrdGRaNkF1VjN1NQpuSjEzU0lYSmFzcCt4akhkOWdpelUwdWhiU0RMN0JxZ1NYNjVnS0VsdGRnZmt5eWZlRFVPNUVyNjB1MzdZK3pNCnJrcWNkTytkL004djdBaktxeW9BM0pXZ1ZWem81d2ErQlFtL1JaV1NGQk9QWnp4THVtQU5UVWlXYW9PTFVyUmEKdGo3WFFHQW9TY0RRS2JoWU4vcE94N3doYmdvd0tHUElmdjdsOFJXUzRkMnMvNnJLblFhVjV3MU1sWHFxbmRaVQpERHhWeWlsUEVqMjQ3WWVaNUhqSFFJZWg4OXo3YnJtM3RWZnFIclRjV3JSV0R4UFNZRWtnbnJkOXQ2YlR6eUhPClBib1AzcE4xK0kwM0hQZnlJSkpNalVrTGVsMGNWODZzaTR5OUFvSE5hMmxoNEFEOGJ6WHE4RTRaY3BKalNhQzYKYXErOUFvSUJBQ3ovbk95US9LeU9DZnhQNDhMR1lpUVhvbFNVaWhPak5hSC9aU2ZLRmhGWDZaTk1iYTZhUFpySQpHZ2RsK3J4NE9EWUZ4VWl0YmVVTXc4dnM0U0h4emN5MnNXbXVqQWN1Q200VUo3R0Z5V2VoaU5lbTNOdmtNajhHCi9Vb1VkOU5wTzJJc3JhL012dTF2aEY3b3lsNG1xbWxDL25xOEpOcE51Q0hESlJ5Rjlzbm1JUmZKOGxOSFVEbnEKSnlHeFNReEM0ZTUxUW9kck94Ykk1eWp0UzJGbm9ZZ3ZyMmFQeHp3dCszZEdreU1QdVlvWnVQVE4ramFPK3JuQQpCanpoUFZPZHg5c0M3SVBWQjVOL3JWYUtIUEloenphV202bjAwSDlYa1RGQ1B3REVMUWt5WEhBclBScGhaN2oyClJibUZRdUtwUU5WMkpzaC9sWm9SWk1sK0F3V21RbWtDZ2dFQkFJb25NeFRaQ0tIOCtya04zbWFqWkgzY3dEUlIKMGs0d2xiMnVyWHNwUkFRMmNSK21IUlRQbGoyMzZ0Tmh4YnZiZHFOS3B5cmFmNjdYTWkxdXpNSE15ZkFWcHloQgpIQk9kMGhzZVNxNDl1YU5yWHY4bVJQS1FIQks2MHNaRkdaSVVyeWhRRXRaSzFackRSTTFsMDFuM3VJR0VGYW1ECnV5QkdMOUhhcW1Ea3FjTWFKVE4vMDlSc3NXbFlxcFhYcUhyaVQrTmFablRUR1FidVQzMmZjeXdaVlpjTVJnWHkKMTVSckcyTjRtT3dVSW0rYXVMQ3pWY0l0N3ZGNld0NUdPMXkzbzkzV2Q2NGRHdVJ1V1R2Qy85MjhPNWdoUjAxVQp5UGh6amd3a1ZDa1hoKzI0QTg5dlZIdWlNNUsxQ2pIMFhBS0hoUVJLNWdjVjQzM1cxUlVvcGpkUFN1Zz0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - # API server specific configuration options. apiServer: image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # Configure the API server admission plugins. admissionControl: - name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: @@ -281,123 +80,35 @@ cluster: runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration - # Configure the API server audit policy. auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - # Controller manager server specific configuration options. controllerManager: image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # Kube-proxy server-specific configuration options proxy: image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # # Disable kube-proxy deployment on cluster bootstrap. - # disabled: false - # Scheduler server specific configuration options. scheduler: image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # Configures cluster member discovery. discovery: enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - # Etcd specific configuration options. etcd: - # The `ca` is the root certificate authority of the PKI. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRT29tdnpMbkx6ZnNjaGt4bWt0RGRQekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURFeE5ERTNOVEl5TWxvWERUTTJNREV4TWpFM05USXlNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkpFa0tDMnRzanp2ClE3ZFpQSS8zcm94TUZlQ1V3QXFrOEgzdTZVWEtDQ0FzeDBENnAvbTd0RzVjU1crNitxSm9wRmZrQW9NK2RjQVIKbkFIQ3FLd1hqVUNqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVK0xtQzhjVmFHeVU0ClRmdTZOUnp5VkFvd2cvUXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdhVWkvNktHMG16WGpXS2o4UVRha2wyOXkKcU5tcEhNUUJzU1V3WkIrWmwzc0NJUUREVUp2bEpjRVVsVDIwVUFQeXNFS1g5RitQQmU4MUxCV0xxZjlXdTk0agpjZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUwvejJObks0b0RoZmFSRDJzSXcyVzBZeGtmN1o2MWQvSmlwaUExVTJ3VnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFa1NRb0xhMnlQTzlEdDFrOGovZXVqRXdWNEpUQUNxVHdmZTdwUmNvSUlDekhRUHFuK2J1MApibHhKYjdyNm9taWtWK1FDZ3o1MXdCR2NBY0tvckJlTlFBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - # # The container image used to create the etcd service. - # image: registry.k8s.io/etcd:v3.6.7 - - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - # A list of urls that point to additional manifests. extraManifests: [] - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - # A list of inline Kubernetes manifests. inlineManifests: [] - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true --- apiVersion: v1alpha1 kind: HostnameConfig -# auto: stable # Commented out — per-node configs use static hostname instead. -# # A static hostname to set for the machine. -# hostname: controlplane1 -# hostname: controlplane1.example.org diff --git a/talos/patches/cp1.yaml b/talos/patches/cp1.yaml new file mode 100644 index 0000000..89e0759 --- /dev/null +++ b/talos/patches/cp1.yaml @@ -0,0 +1,3 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-cp1 diff --git a/talos/patches/cp2.yaml b/talos/patches/cp2.yaml new file mode 100644 index 0000000..ff763b3 --- /dev/null +++ b/talos/patches/cp2.yaml @@ -0,0 +1,3 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-cp2 diff --git a/talos/patches/cp3.yaml b/talos/patches/cp3.yaml new file mode 100644 index 0000000..f0b9d7e --- /dev/null +++ b/talos/patches/cp3.yaml @@ -0,0 +1,3 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-cp3 diff --git a/talos/patches/worker1.yaml b/talos/patches/worker1.yaml new file mode 100644 index 0000000..2fb170f --- /dev/null +++ b/talos/patches/worker1.yaml @@ -0,0 +1,3 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-worker1 diff --git a/talos/patches/worker2.yaml b/talos/patches/worker2.yaml new file mode 100644 index 0000000..4ecaf74 --- /dev/null +++ b/talos/patches/worker2.yaml @@ -0,0 +1,3 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-worker2 diff --git a/talos/patches/worker3.yaml b/talos/patches/worker3.yaml new file mode 100644 index 0000000..dce90fb --- /dev/null +++ b/talos/patches/worker3.yaml @@ -0,0 +1,3 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos-worker3 diff --git a/talos/patches/worker4.yaml b/talos/patches/worker4.yaml new file mode 100644 index 0000000..8235dfc --- /dev/null +++ b/talos/patches/worker4.yaml @@ -0,0 +1,7 @@ +apiVersion: v1alpha1 +kind: HostnameConfig +hostname: talos4 +--- +machine: + install: + disk: /dev/sdb diff --git a/talos/worker.yaml b/talos/worker.yaml index 5726cf2..a71bf11 100644 --- a/talos/worker.yaml +++ b/talos/worker.yaml @@ -1,426 +1,67 @@ version: v1alpha1 # Indicates the schema used to decode the contents. debug: false # Enable verbose logging to the console. persist: true -# Provides machine specific configuration options. machine: type: worker # Defines the role of the machine within the cluster. token: t6u2b3.xkpavh9cex6s9958 # The `token` is used by a machine to join the PKI of the cluster. - # The root certificate authority of the PKI. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEJ0bzdreDVONWg2QXVwZE9Nd2ovUHVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQXhNVFF4TnpVeU1qSmFGdzB6TmpBeE1USXhOelV5TWpKYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBTHNqQ1VJaDcvQUQ5RFYvS3RpVU45WmdibGYxNmE4Q2NkSm95Cjc1Rk84SmlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVd2lQcTN2U29nUlFOVEFYMQpBL1ZTRDVtS2U2Y3dCUVlESzJWd0EwRUE3UGQvUll4ekc4NXBmdVU1b1k4WnQ3dkpSM1BhNzM0ZW1aaWY3QzdSCmg5Qmx0SWx6NUFnbXFnSWdQSzlhOCt2VXpCa2p0M05scHFpZGZONzUwSTQ1QUE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: "" - # Extra certificate subject alternative names for the machine's certificate. certSANs: [] - # # Uncomment this to enable SANs. - # - 10.0.0.10 - # - 172.16.0.10 - # - 192.168.0.10 - # Used to provide additional options to the kubelet. kubelet: image: ghcr.io/siderolabs/kubelet:v1.36.1 # The `image` field is an optional reference to an alternative kubelet image. defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile. disableManifestsDirectory: true # Disable static pod manifest directory. - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraArgs` field is used to provide additional flags to the kubelet. - # extraArgs: - # key: value - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration. - # credentialProviderConfig: - # apiVersion: kubelet.config.k8s.io/v1 - # kind: CredentialProviderConfig - # providers: - # - apiVersion: credentialprovider.kubelet.k8s.io/v1 - # defaultCacheDuration: 12h - # matchImages: - # - '*.dkr.ecr.*.amazonaws.com' - # - '*.dkr.ecr.*.amazonaws.com.cn' - # - '*.dkr.ecr-fips.*.amazonaws.com' - # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov' - # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov' - # name: ecr-credential-provider - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 - # Provides machine specific network configuration options. network: nameservers: - 9.9.9.9 - 149.112.112.112 - 1.1.1.1 - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. - # Used to provide instructions for installations. install: disk: /dev/sda # The disk used for installations. - image: ghcr.io/siderolabs/installer:v1.13.3 # Talos installer. + image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.13.3 # Talos installer (factory image with iscsi-tools, util-linux-tools, qemu-guest-agent, tailscale). + grubUseUKICmdline: true # Use UKI cmdline instead of building from host. wipe: false # Indicates if the installation disk should be wiped at installation time. - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. disks: [] registries: {} - # Features describe individual Talos features that can be switched on or off. features: diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks. - # KubePrism - local proxy/load balancer on defined port that will distribute kubePrism: enabled: true # Enable KubePrism support - will start local load balancing proxy. port: 7445 # KubePrism port. - # Configures host DNS caching resolver. hostDNS: enabled: true # Enable host DNS caching resolver. forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods. - # # Configure Talos API access from Kubernetes pods. - # kubernetesTalosAPIAccess: - # enabled: true # Enable Talos API access from Kubernetes pods. - # # The list of Talos API roles which can be granted for access from Kubernetes pods. - # allowedRoles: - # - os:reader - # # The list of Kubernetes namespaces Talos API access is available from. - # allowedKubernetesNamespaces: - # - kube-system - - # # Provides machine specific control plane configuration options. - - # # ControlPlane definition example. - # controlPlane: - # # Controller manager machine specific configuration options. - # controllerManager: - # disabled: false # Disable kube-controller-manager on the node. - # # Scheduler machine specific configuration options. - # scheduler: - # disabled: true # Disable kube-scheduler on the node. - - # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. - - # # nginx static pod. - # pods: - # - apiVersion: v1 - # kind: pod - # metadata: - # name: nginx - # spec: - # containers: - # - image: nginx - # name: nginx - - # # Allows the addition of user specified files. - - # # MachineFiles usage example. - # files: - # - content: '...' # The contents of the file. - # permissions: 0o666 # The file's permissions in octal. - # path: /tmp/file.txt # The path of the file. - # op: append # The operation to use - - # # The `env` field allows for the addition of environment variables. - - # # Environment variables definition examples. - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: info - # GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - # https_proxy: http://SERVER:PORT/ - # env: - # GRPC_GO_LOG_SEVERITY_LEVEL: error - # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ - # env: - # https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ - - # # Used to configure the machine's sysctls. - - # # MachineSysctls usage example. - # sysctls: - # kernel.domainname: talos.dev - # net.ipv4.ip_forward: "0" - # net/ipv6/conf/eth0.100/disable_ipv6: "1" - - # # Used to configure the machine's sysfs. - - # # MachineSysfs usage example. - # sysfs: - # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance - - # # Configures the udev system. - # udev: - # # List of udev rules to apply to the udev system - # rules: - # - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" - - # # Configures the logging system. - # logging: - # # Logging destination. - # destinations: - # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - # format: json_lines # Logs format. - - # # Configures the kernel. - # kernel: - # # Kernel modules to load. - # modules: - # - name: btrfs # Module name. - - # # Configures the seccomp profiles for the machine. - # seccompProfiles: - # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. - # # The `value` field is used to provide the seccomp profile. - # value: - # defaultAction: SCMP_ACT_LOG - - # # Override (patch) settings in the default OCI runtime spec for CRI containers. - - # # override default open file limit - # baseRuntimeSpecOverrides: - # process: - # rlimits: - # - hard: 1024 - # soft: 1024 - # type: RLIMIT_NOFILE - - # # Configures the node labels for the machine. - - # # node labels example. - # nodeLabels: - # exampleLabel: exampleLabelValue - - # # Configures the node annotations for the machine. - - # # node annotations example. - # nodeAnnotations: - # customer.io/rack: r13a25 - - # # Configures the node taints for the machine. Effect is optional. - - # # node taints example. - # nodeTaints: - # exampleTaint: exampleTaintValue:NoSchedule -# Provides cluster specific configuration options. cluster: id: d9wM2zW6ZcxGVQp8rujQajusx-HrV1s-gRfGfc5wExM= # Globally unique identifier for this cluster (base64 encoded random 32 bytes). secret: V44y9ckGbghbUYYuLTqjagj0jzx3TcgfZ9a7C9J97mE= # Shared secret of cluster (base64 encoded random 32 bytes). - # Provides control plane specific configuration options. controlPlane: endpoint: https://10.0.15.1:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. clusterName: home-cluster # Configures the cluster's name. - # Provides cluster specific network configuration options. network: dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 - # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12 - # # The CNI used. - # cni: - # name: custom # Name of CNI to use. - # # URLs containing manifests to apply for the CNI. - # urls: - # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml token: jhs5w8.tnf0lrt6ouico21x # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - # The base64 encoded root certificate authority used by Kubernetes. ca: crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQU5pSitIN3JtY0VEa3AxZ1BZMEpSVWt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF4TVRReE56VXlNakphRncwek5qQXhNVEl4TnpVeQpNakphTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRRMUpQeWl2bjkzc0FHSUhTUzJBN0VnQTI2N3ZJM0pWcC9rMWZQWnFNRnpmNHlmRHBwTUQ5cG42SEQKWUx2SjkyazNGRkRoYXh2UDZIUTRRQVV3UW5Mcm8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTXhodGtYOHZUbEtGMkJ4THBqUXhJZGRuNzJuTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDeGNaTTQKZ09RTHplU1BrSy9HTnZaV3pueTBoSXM0ZmUrYVJOMENhN1A2UndJaEFJSHc0Ni9EaDJtTWZLQm9GS3hmTnJWTQpiaVNoekF1QzQ2THdVZXJyNmNBcQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== key: "" - # Configures cluster member discovery. discovery: enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: disabled: true # Disable Kubernetes discovery registry. - # Service registry is using an external service to push and pull information about cluster members. service: {} - # # External service endpoint. - # endpoint: https://discovery.talos.dev/ - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - # # Decryption secret example (do not use in production!). - # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - - # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - - # # AggregatorCA example. - # aggregatorCA: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # The base64 encoded private key for service account token generation. - - # # AggregatorCA example. - # serviceAccount: - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - - # # API server specific configuration options. - # apiServer: - # image: registry.k8s.io/kube-apiserver:v1.36.1 # The container image used in the API server manifest. - # # Extra arguments to supply to the API server. - # extraArgs: - # feature-gates: ServerSideApply=true - # http2-max-streams-per-connection: "32" - # # Extra certificate subject alternative names for the API server's certificate. - # certSANs: - # - 1.2.3.4 - # - 4.5.6.7 - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration - # # Configure the API server audit policy. - # auditPolicy: - # apiVersion: audit.k8s.io/v1 - # kind: Policy - # rules: - # - level: Metadata - # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration. - # authorizationConfig: - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: webhook # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: Deny - # matchConditionSubjectAccessReviewVersion: v1 - # matchConditions: - # - expression: has(request.resourceAttributes) - # - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)' - # subjectAccessReviewVersion: v1 - # timeout: 3s - # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`. - # name: in-cluster-authorizer # Name is used to describe the authorizer. - # # webhook is the configuration for the webhook authorizer. - # webhook: - # connectionInfo: - # type: InClusterConfig - # failurePolicy: NoOpinion - # matchConditionSubjectAccessReviewVersion: v1 - # subjectAccessReviewVersion: v1 - # timeout: 3s - - # # Controller manager server specific configuration options. - # controllerManager: - # image: registry.k8s.io/kube-controller-manager:v1.36.1 # The container image used in the controller manager manifest. - # # Extra arguments to supply to the controller manager. - # extraArgs: - # feature-gates: ServerSideApply=true - - # # Kube-proxy server-specific configuration options - # proxy: - # disabled: false # Disable kube-proxy deployment on cluster bootstrap. - # image: registry.k8s.io/kube-proxy:v1.36.1 # The container image used in the kube-proxy manifest. - # mode: ipvs # proxy mode of kube-proxy. - # # Extra arguments to supply to kube-proxy. - # extraArgs: - # proxy-mode: iptables - - # # Scheduler server specific configuration options. - # scheduler: - # image: registry.k8s.io/kube-scheduler:v1.36.1 # The container image used in the scheduler manifest. - # # Extra arguments to supply to the scheduler. - # extraArgs: - # feature-gates: AllBeta=true - - # # Etcd specific configuration options. - # etcd: - # image: registry.k8s.io/etcd:v3.6.7 # The container image used to create the etcd service. - # # The `ca` is the root certificate authority of the PKI. - # ca: - # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t - # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== - # # Extra arguments to supply to etcd. - # extraArgs: - # election-timeout: "5000" - # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. - # advertisedSubnets: - # - 10.0.0.0/8 - - # # Core DNS specific configuration options. - # coreDNS: - # image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image. - - # # External cloud provider configuration. - # externalCloudProvider: - # enabled: true # Enable external cloud provider. - # # A list of urls that point to additional manifests for an external cloud provider. - # manifests: - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml - - # # A list of urls that point to additional manifests. - # extraManifests: - # - https://www.example.com/manifest1.yaml - # - https://www.example.com/manifest2.yaml - - # # A map of key value pairs that will be added while fetching the extraManifests. - # extraManifestHeaders: - # Token: "1234567" - # X-ExtraInfo: info - - # # A list of inline Kubernetes manifests. - # inlineManifests: - # - name: namespace-ci # Name of the manifest. - # contents: |- # Manifest contents as a string. - # apiVersion: v1 - # kind: Namespace - # metadata: - # name: ci - - # # Settings for admin kubeconfig generation. - # adminKubeconfig: - # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). - - # # Allows running workload on control-plane nodes. - # allowSchedulingOnControlPlanes: true --- apiVersion: v1alpha1 kind: HostnameConfig -# auto: stable # Commented out — per-node configs use static hostname instead. -# # A static hostname to set for the machine. -# hostname: controlplane1 -# hostname: controlplane1.example.org