chore: initial commit 🚀

talos/README.md

@@ -0,0 +1,20 @@
+# Talos Patching
+
+Machine configs are assembled by [topf](https://postfinance.github.io/topf/) from
+`topf.yaml` plus the strategic merge patches in this directory.
+
+<https://www.talos.dev/latest/talos-guides/configuration/patching/>
+
+## Patch Directories
+
+Patches merge in this order, alphabetically within each directory, with later
+patches taking precedence:
+
+- `all/`: applied to every node
+- `control-plane/`: applied to control-plane nodes
+- `worker/`: applied to worker nodes
+- `node/${hostname}/`: applied to the node with the specified name
+
+Files ending in `.yaml.tpl` are Go-templated per node; see the
+[topf configuration model](https://postfinance.github.io/topf/main/configuration-model/)
+for the available template variables.

talos/all/00-install.yaml.tpl

@@ -0,0 +1,9 @@
+apiVersion: v1alpha1
+kind: UnattendedInstallConfig
+provisioning:
+  diskSelector:
+    {{- if .Node.Data.installDisk }}
+    match: disk.dev_path == "{{ .Node.Data.installDisk }}" || "{{ .Node.Data.installDisk }}" in disk.symlinks
+    {{- else }}
+    match: disk.serial == "{{ .Node.Data.installDiskSerial }}"
+    {{- end }}

talos/all/01-hostname.yaml.tpl

@@ -0,0 +1,4 @@
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: "off"
+hostname: "{{ .Node.Host }}"

talos/all/10-cluster.yaml

@@ -0,0 +1,9 @@
+machine:
+  certSANs:
+    - "127.0.0.1"
+    - "192.168.40.10"
+---
+apiVersion: v1alpha1
+kind: KubeNetworkConfig
+podSubnets: ["10.42.0.0/16"]
+serviceSubnets: ["10.43.0.0/16"]

talos/all/20-network-links.yaml.tpl

@@ -0,0 +1,25 @@
+---
+apiVersion: v1alpha1
+kind: LinkAliasConfig
+name: ethSel0
+selector:
+  match: glob("{{ .Node.Data.macAddr }}", mac(link.hardware_addr))
+---
+apiVersion: v1alpha1
+kind: BondConfig
+name: bond0
+links:
+  - ethSel0
+bondMode: active-backup
+mtu: {{ .Node.Data.mtu }}
+addresses:
+  - address: "{{ .Node.IP }}/24"
+routes:
+  - gateway: "192.168.40.1"
+{{- if eq .Node.Role "control-plane" }}
+---
+apiVersion: v1alpha1
+kind: Layer2VIPConfig
+link: bond0
+name: "192.168.40.10"
+{{- end }}

talos/all/21-network.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers:
+  - address: 192.168.40.1
+  - address: 1.1.1.1
+searchDomains:
+  disableDefault: true

talos/all/22-time.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1alpha1
+kind: TimeSyncConfig
+ntp:
+  servers:
+    - 192.168.40.1
+    - 162.159.200.1

talos/all/30-kubelet.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1alpha1
+kind: KubeletConfig
+config:
+  crashLoopBackOff:
+    maxContainerRestartPeriod: 60s
+  imageMaximumGCAge: 168h
+  maxParallelImagePulls: 3
+  serializeImagePulls: false
+  shutdownGracePeriod: 90s
+  shutdownGracePeriodCriticalPods: 60s
+---
+apiVersion: v1alpha1
+kind: KubeNodeConfig
+nodeIP:
+  validSubnets:
+    - 192.168.40.0/24

talos/all/40-sysctls.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1alpha1
+kind: SysctlConfig
+params:
+  fs.inotify.max_user_watches: "1048576" # Watchdog
+  fs.inotify.max_user_instances: "8192" # Watchdog
+  net.core.rmem_max: "7500000" # Cloudflared | QUIC
+  net.core.wmem_max: "7500000" # Cloudflared | QUIC
+  net.ipv4.neigh.default.gc_thresh1: "4096" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh2: "8192" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh3: "16384" # Prevent ARP cache overflows
+  net.ipv4.tcp_slow_start_after_idle: "0" # Preserve congestion window after idle
+  user.max_user_namespaces: "11255" # User Namespaces

talos/all/50-files.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1alpha1
+kind: CRICustomizationConfig
+name: containerd
+content: |
+  [plugins."io.containerd.cri.v1.images"]
+    discard_unpacked_layers = false
+  [plugins."io.containerd.cri.v1.runtime"]
+    device_ownership_from_security_context = true

talos/all/60-encryption.yaml.tpl

@@ -0,0 +1,20 @@
+{{- if .Node.Data.encryptDisk }}
+# Encrypt system disk with TPM
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: STATE
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+---
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+{{- end }}

talos/all/61-kernel-modules.yaml.tpl

@@ -0,0 +1,6 @@
+{{- range .Node.Data.kernelModules }}
+---
+apiVersion: v1alpha1
+kind: KernelModuleConfig
+name: {{ . }}
+{{- end }}

talos/all/70-security.yaml

@@ -0,0 +1,7 @@
+# Talos 1.14 defaults to running kubelet and pods in a sandboxed PID/mount
+# namespace, which breaks workloads that rely on hostPID or host mounts
+# (node-exporter, GPU plugins, in-tree iSCSI). Set to true to opt in; on
+# encrypted disks expect a second reboot the first time it is enabled.
+apiVersion: v1alpha1
+kind: SecurityProfileConfig
+workloadIsolation: false

talos/all/71-filesystem.yaml

@@ -0,0 +1,9 @@
+# Weekly online maintenance for XFS volumes: trim discards unused blocks
+# (SSDs, thin provisioning) and scrub checks filesystem metadata.
+apiVersion: v1alpha1
+kind: FilesystemTrimConfig
+interval: 168h0m0s
+---
+apiVersion: v1alpha1
+kind: FilesystemScrubConfig
+interval: 168h0m0s

talos/control-plane/00-cluster.yaml

@@ -0,0 +1,61 @@
+cluster:
+  etcd:
+    extraArgs:
+      listen-metrics-urls: http://0.0.0.0:2381
+    advertisedSubnets:
+      - 192.168.40.0/24
+---
+# Allow scheduling on control-plane nodes
+apiVersion: v1alpha1
+kind: KubeNodeConfig
+taints:
+  node-role.kubernetes.io/control-plane:
+    $patch: delete
+---
+apiVersion: v1alpha1
+kind: KubeAdmissionControlConfig
+name: PodSecurity
+$patch: delete
+---
+apiVersion: v1alpha1
+kind: KubeAPIServerConfig
+certExtraSANs:
+  - "127.0.0.1"
+  - "192.168.40.10"
+extraArgs:
+  # https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/
+  enable-aggregator-routing: "true"
+---
+apiVersion: v1alpha1
+kind: KubeControllerManagerConfig
+extraArgs:
+  bind-address: 0.0.0.0
+---
+apiVersion: v1alpha1
+kind: KubeCoreDNSConfig
+enabled: false
+---
+# Disable built-in CNI and kube-proxy to use Cilium
+apiVersion: v1alpha1
+kind: KubeFlannelCNIConfig
+$patch: delete
+---
+apiVersion: v1alpha1
+kind: KubeProxyConfig
+enabled: false
+---
+apiVersion: v1alpha1
+kind: KubeSchedulerConfig
+extraArgs:
+  bind-address: 0.0.0.0
+config:
+  profiles:
+    - schedulerName: default-scheduler
+      pluginConfig:
+        - name: PodTopologySpread
+          args:
+            defaultingType: List
+            defaultConstraints:
+              - maxSkew: 1
+                topologyKey: kubernetes.io/hostname
+                whenUnsatisfiable: ScheduleAnyway

talos/mod.just

@@ -0,0 +1,64 @@
+set quiet
+set shell := ['bash', '-euo', 'pipefail', '-c']
+set script-interpreter := ['bash', '-euo', 'pipefail']
+set default-list
+set default-script
+
+# Day-2 apply/upgrade recipes rely on topf's built-in diff-and-confirm
+# prompt; only the destructive reset recipes disable it in favour of just's
+# own confirmation.
+
+[doc('Apply Talos config to all nodes (shows a diff and asks first)')]
+[group('talos')]
+apply:
+    topf apply
+
+[arg('mode', pattern='auto|reboot|no-reboot|staged|try')]
+[doc('Apply Talos config to a node (shows a diff and asks first)')]
+[group('talos')]
+apply-node node mode='auto':
+    topf apply --nodes-filter "^{{ node }}$" --mode "{{ mode }}"
+
+[doc('Show pending config changes without applying them')]
+[group('talos')]
+diff:
+    topf apply --dry-run
+
+[doc('List all nodes and their current state')]
+[group('talos')]
+nodes:
+    topf nodes
+
+[doc('Render Talos machine configs to ./rendered')]
+[group('talos')]
+render:
+    topf render --output ./rendered
+
+[confirm("This will destroy your cluster and reset all nodes to maintenance mode — continue? [y/N]")]
+[doc('Reset all nodes back to maintenance mode (DESTRUCTIVE)')]
+[group('talos')]
+reset:
+    topf reset --confirm=false
+
+[confirm("This will reset node " + node + " to maintenance mode — continue? [y/N]")]
+[doc('Reset a single node back to maintenance mode (DESTRUCTIVE)')]
+[group('talos')]
+reset-node node:
+    topf reset --nodes-filter "^{{ node }}$" --confirm=false
+
+# topf intentionally does not manage Kubernetes upgrades
+[doc('Upgrade Kubernetes')]
+[group('talos')]
+upgrade-k8s:
+    talosctl --nodes "$(yq '[.nodes[] | select(.role == "control-plane")][0].ip' topf.yaml)" \
+        upgrade-k8s --to "$(yq '.kubernetesVersion' topf.yaml)"
+
+[doc('Upgrade Talos on all nodes, one at a time (asks first)')]
+[group('talos')]
+upgrade:
+    topf upgrade
+
+[doc('Upgrade Talos on a single node (asks first)')]
+[group('talos')]
+upgrade-node node:
+    topf upgrade --nodes-filter "^{{ node }}$"

talos/topf.yaml

@@ -0,0 +1,45 @@
+---
+clusterName: kubernetes
+clusterEndpoint: https://192.168.40.10:6443
+
+# renovate: datasource=github-releases depName=siderolabs/talos
+talosVersion: v1.14.0
+# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+kubernetesVersion: v1.37.0
+
+secretsPath: secrets.sops.yaml
+
+nodes:
+  - host: "k8s-0"
+    ip: "192.168.40.20"
+    role: control-plane
+    schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
+    data:
+      installDisk: "/dev/sda"
+      installDiskSerial: ""
+      macAddr: "bc:24:11:00:00:20"
+      mtu: 1500
+      encryptDisk: false
+      kernelModules: []
+  - host: "k8s-1"
+    ip: "192.168.40.21"
+    role: control-plane
+    schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
+    data:
+      installDisk: "/dev/sda"
+      installDiskSerial: ""
+      macAddr: "bc:24:11:00:00:21"
+      mtu: 1500
+      encryptDisk: false
+      kernelModules: []
+  - host: "k8s-2"
+    ip: "192.168.40.22"
+    role: control-plane
+    schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
+    data:
+      installDisk: "/dev/sda"
+      installDiskSerial: ""
+      macAddr: "bc:24:11:00:00:22"
+      mtu: 1500
+      encryptDisk: false
+      kernelModules: []