chore: initial commit 🚀

talos/all/00-install.yaml.tpl

@@ -0,0 +1,9 @@
+apiVersion: v1alpha1
+kind: UnattendedInstallConfig
+provisioning:
+  diskSelector:
+    {{- if .Node.Data.installDisk }}
+    match: disk.dev_path == "{{ .Node.Data.installDisk }}" || "{{ .Node.Data.installDisk }}" in disk.symlinks
+    {{- else }}
+    match: disk.serial == "{{ .Node.Data.installDiskSerial }}"
+    {{- end }}

talos/all/01-hostname.yaml.tpl

@@ -0,0 +1,4 @@
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: "off"
+hostname: "{{ .Node.Host }}"

talos/all/10-cluster.yaml

@@ -0,0 +1,9 @@
+machine:
+  certSANs:
+    - "127.0.0.1"
+    - "192.168.40.10"
+---
+apiVersion: v1alpha1
+kind: KubeNetworkConfig
+podSubnets: ["10.42.0.0/16"]
+serviceSubnets: ["10.43.0.0/16"]

talos/all/20-network-links.yaml.tpl

@@ -0,0 +1,25 @@
+---
+apiVersion: v1alpha1
+kind: LinkAliasConfig
+name: ethSel0
+selector:
+  match: glob("{{ .Node.Data.macAddr }}", mac(link.hardware_addr))
+---
+apiVersion: v1alpha1
+kind: BondConfig
+name: bond0
+links:
+  - ethSel0
+bondMode: active-backup
+mtu: {{ .Node.Data.mtu }}
+addresses:
+  - address: "{{ .Node.IP }}/24"
+routes:
+  - gateway: "192.168.40.1"
+{{- if eq .Node.Role "control-plane" }}
+---
+apiVersion: v1alpha1
+kind: Layer2VIPConfig
+link: bond0
+name: "192.168.40.10"
+{{- end }}

talos/all/21-network.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers:
+  - address: 192.168.40.1
+  - address: 1.1.1.1
+searchDomains:
+  disableDefault: true

talos/all/22-time.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1alpha1
+kind: TimeSyncConfig
+ntp:
+  servers:
+    - 192.168.40.1
+    - 162.159.200.1

talos/all/30-kubelet.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1alpha1
+kind: KubeletConfig
+config:
+  crashLoopBackOff:
+    maxContainerRestartPeriod: 60s
+  imageMaximumGCAge: 168h
+  maxParallelImagePulls: 3
+  serializeImagePulls: false
+  shutdownGracePeriod: 90s
+  shutdownGracePeriodCriticalPods: 60s
+---
+apiVersion: v1alpha1
+kind: KubeNodeConfig
+nodeIP:
+  validSubnets:
+    - 192.168.40.0/24

talos/all/40-sysctls.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1alpha1
+kind: SysctlConfig
+params:
+  fs.inotify.max_user_watches: "1048576" # Watchdog
+  fs.inotify.max_user_instances: "8192" # Watchdog
+  net.core.rmem_max: "7500000" # Cloudflared | QUIC
+  net.core.wmem_max: "7500000" # Cloudflared | QUIC
+  net.ipv4.neigh.default.gc_thresh1: "4096" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh2: "8192" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh3: "16384" # Prevent ARP cache overflows
+  net.ipv4.tcp_slow_start_after_idle: "0" # Preserve congestion window after idle
+  user.max_user_namespaces: "11255" # User Namespaces

talos/all/50-files.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1alpha1
+kind: CRICustomizationConfig
+name: containerd
+content: |
+  [plugins."io.containerd.cri.v1.images"]
+    discard_unpacked_layers = false
+  [plugins."io.containerd.cri.v1.runtime"]
+    device_ownership_from_security_context = true

talos/all/60-encryption.yaml.tpl

@@ -0,0 +1,20 @@
+{{- if .Node.Data.encryptDisk }}
+# Encrypt system disk with TPM
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: STATE
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+---
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+{{- end }}

talos/all/61-kernel-modules.yaml.tpl

@@ -0,0 +1,6 @@
+{{- range .Node.Data.kernelModules }}
+---
+apiVersion: v1alpha1
+kind: KernelModuleConfig
+name: {{ . }}
+{{- end }}

talos/all/70-security.yaml

@@ -0,0 +1,7 @@
+# Talos 1.14 defaults to running kubelet and pods in a sandboxed PID/mount
+# namespace, which breaks workloads that rely on hostPID or host mounts
+# (node-exporter, GPU plugins, in-tree iSCSI). Set to true to opt in; on
+# encrypted disks expect a second reboot the first time it is enabled.
+apiVersion: v1alpha1
+kind: SecurityProfileConfig
+workloadIsolation: false

talos/all/71-filesystem.yaml

@@ -0,0 +1,9 @@
+# Weekly online maintenance for XFS volumes: trim discards unused blocks
+# (SSDs, thin provisioning) and scrub checks filesystem metadata.
+apiVersion: v1alpha1
+kind: FilesystemTrimConfig
+interval: 168h0m0s
+---
+apiVersion: v1alpha1
+kind: FilesystemScrubConfig
+interval: 168h0m0s