fix: resolve talos config issues, Cloudflare v5 migration, and security cleanup

- Remove sensitive files from git tracking (kubeconfig, secrets.yaml.backup,
  talosconfig.backup) and update .gitignore
- Fix installer version drift: v1.12.4 -> v1.12.6 across all talos configs
- Fix grubUseUKICmdline + extraKernelArgs conflict on CP configs
- Remove tailscale extension from stock installer CP configs (won't work)
- Add nameservers to controlplane and per-node configs
- Add time servers to all per-node worker configs
- Fix HostnameConfig auto: stable in base templates
- Clean up doc drift (README.md, CLAUDE.md) for worker count and storage
- Remove all Longhorn references (worker configs, documentation)
- Migrate Cloudflare provider v4 -> v5 with full resource refactoring:
  cloudflare_record -> cloudflare_dns_record,
  zone_settings_override -> zone_setting,
  block -> attribute syntax for rulesets, data, and tunnel configs
- Fix firewall expression (not http.user_agent ne '' -> not exists)

2026-06-04 14:58:09 -05:00

3.3 KiB

Raw Blame History

Talos Home Cluster

Cluster Information

Cluster Name: home-cluster
Kubernetes Version: v1.35.0
Control Plane Nodes: 3 (10.0.15.1-3)
Worker Nodes: 4 (10.0.15.4-7)
Bare Metal Worker: talos4 at 10.0.15.7 (HP t620)
API Endpoint: https://10.0.15.1:6443

Node Details

Node Name	Role	IP	Proxmox Node	VMID
talos-cp1	Control Plane	10.0.15.1	node1	200
talos-cp2	Control Plane	10.0.15.2	node2	201
talos-cp3	Control Plane	10.0.15.3	node3	202
talos-worker1	Worker	10.0.15.4	node1	210
talos-worker2	Worker	10.0.15.5	node2	211
talos-worker3	Worker	10.0.15.6	node3	212
talos4	Worker	10.0.15.7	bare-metal (HP t620)	—

Configuration Files

secrets.yaml - Cluster secrets (keep secure!)
controlplane.yaml - Control plane node configuration
worker.yaml - Worker node configuration
talosconfig - Talosctl client configuration

Using the Cluster

Talosctl Commands

# Check cluster health
talosctl --talosconfig talosconfig health

# Get node list
talosctl --talosconfig talosconfig get members

# View logs from a node
talosctl --talosconfig talosconfig logs -f kubelet

# Check service status
talosctl --talosconfig talosconfig service

# Upgrade Talos (example)
talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.12.6

Kubectl Commands

The kubeconfig has been merged into your default kubectl config:

# View nodes
kubectl get nodes

# View all pods
kubectl get pods -A

# View cluster info
kubectl cluster-info

Storage Configuration

VM boot disks are stored on local-lvm on each Proxmox node (no shared Ceph storage). For Kubernetes persistent storage, deploy a CSI provisioner (e.g. Rook-Ceph, OpenEBS, or cloud provider CSI).

Networking

CNI: Flannel (deployed by default)
Service CIDR: Default Kubernetes range
Pod CIDR: Default Kubernetes range

Maintenance

Adding a Node

Clone VM from template in Terraform

Apply appropriate config:

talosctl --talosconfig talosconfig apply-config --insecure --nodes <NEW_NODE_IP> --file controlplane.yaml

Removing a Node

# Drain node first
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

# Remove from cluster
kubectl delete node <node-name>

# Reset Talos on the node
talosctl --talosconfig talosconfig reset --nodes <NODE_IP>

Upgrading Kubernetes

talosctl --talosconfig talosconfig upgrade-k8s --to 1.35.0

Troubleshooting

Node not joining cluster

# Check node logs
talosctl --talosconfig talosconfig logs -f kubelet --nodes <NODE_IP>

# Check etcd members
talosctl --talosconfig talosconfig etcd members

Reset a Node

talosctl --talosconfig talosconfig reset --nodes <NODE_IP> --graceful=false

Reboot a Node

talosctl --talosconfig talosconfig reboot --nodes <NODE_IP>

Backup

Important files to backup:

secrets.yaml - Required to add nodes or recover cluster
talosconfig - Required for talosctl access
Node configs in configs/ directory
Kubeconfig is stored in ~/.kube/config

Store these securely in a password manager or encrypted backup.

3.3 KiB Raw Blame History