chore: tidy up 🧹
This commit is contained in:
@@ -1,12 +0,0 @@
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumNetworkPolicy
|
||||
metadata:
|
||||
name: e2e-deny-server
|
||||
namespace: default
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: e2e-network-server
|
||||
ingress:
|
||||
- {}
|
||||
@@ -1,291 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Full-fidelity bootstrap e2e: takes maintenance-mode Talos VMs, discovers
|
||||
# their hardware the same way the README instructs users to, writes a
|
||||
# cluster.toml from the discovered facts, and runs the template's real
|
||||
# bootstrap flow against them.
|
||||
#
|
||||
# Two provisioning paths share this test body:
|
||||
# - CI: talosctl-cluster-action boots the nodes (talos-cluster.yaml) and
|
||||
# passes E2E_CONTROLPLANE_IPS / E2E_WORKER_IPS / E2E_CIDR; the action's
|
||||
# post step destroys them.
|
||||
# - Local: run with no env set; the script boots and destroys the cluster
|
||||
# itself. Requires Docker, /dev/kvm, passwordless sudo, qemu-system-x86,
|
||||
# and the repo's mise toolchain on PATH.
|
||||
#
|
||||
# Renders into the working tree like any configure run.
|
||||
set -euo pipefail
|
||||
|
||||
NAME="${E2E_NAME:-template-e2e}"
|
||||
MODE="${1:-all}"
|
||||
E2E_DIR=".github/template-tests/e2e"
|
||||
CIDR="${E2E_CIDR:-10.9.0.0/24}"
|
||||
PREFIX="${CIDR%/*}"
|
||||
PREFIX="${PREFIX%.*}"
|
||||
TALOSCTL="$(command -v talosctl)"
|
||||
# The Image Factory vanilla schematic, matching the ISO the nodes boot from.
|
||||
SCHEMATIC="376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
if [ -n "${E2E_CONTROLPLANE_IPS:-}" ]; then
|
||||
PROVISIONED=true
|
||||
IFS=',' read -r -a CONTROLPLANES <<< "$E2E_CONTROLPLANE_IPS"
|
||||
IFS=',' read -r -a WORKERS <<< "${E2E_WORKER_IPS:-}"
|
||||
else
|
||||
PROVISIONED=false
|
||||
CONTROLPLANES=("$PREFIX.2")
|
||||
WORKERS=("$PREFIX.3")
|
||||
fi
|
||||
NODES=("${CONTROLPLANES[@]}" "${WORKERS[@]}")
|
||||
# The VMs reach the host at the gateway address; the rendered workspace is
|
||||
# served from there over git smart HTTP so Flux can sync it.
|
||||
GIT_HOST="${E2E_GATEWAY:-$PREFIX.1}"
|
||||
GIT_PORT=8418
|
||||
GIT_SERVER_CONTAINER=""
|
||||
|
||||
# The provisioner runs under sudo and writes state relative to its cwd and
|
||||
# TALOSCONFIG, so both are pointed at a scratch dir to keep root-owned files
|
||||
# out of the repo.
|
||||
if [ -n "${E2E_STATE:-}" ]; then
|
||||
STATE="$E2E_STATE"
|
||||
STATE_OWNED=false
|
||||
else
|
||||
STATE="$(mktemp -d)"
|
||||
STATE_OWNED=true
|
||||
fi
|
||||
mkdir -p "$STATE"
|
||||
GIT_PUSH_URL="http://127.0.0.1:$GIT_PORT/repo.git"
|
||||
|
||||
cleanup() {
|
||||
rc=$?
|
||||
if [ "$rc" -ne 0 ]; then
|
||||
echo "==> e2e failed (rc=$rc), collecting diagnostics"
|
||||
kubectl get pods --all-namespaces 2>/dev/null || true
|
||||
kubectl get gitrepositories,kustomizations,helmreleases --all-namespaces 2>/dev/null || true
|
||||
kubectl get events --all-namespaces --sort-by=.lastTimestamp 2>/dev/null | tail -30 || true
|
||||
[ -n "$GIT_SERVER_CONTAINER" ] && docker logs --tail 5 "$GIT_SERVER_CONTAINER" 2>/dev/null || true
|
||||
for ip in "${NODES[@]}"; do
|
||||
talosctl -n "$ip" dmesg 2>/dev/null | tail -20 || true
|
||||
done
|
||||
fi
|
||||
if [ "$MODE" = all ]; then
|
||||
[ -n "$GIT_SERVER_CONTAINER" ] && docker stop "$GIT_SERVER_CONTAINER" >/dev/null 2>&1 || true
|
||||
fi
|
||||
if [ "$MODE" = all ] && [ "$PROVISIONED" = false ]; then
|
||||
(cd "$STATE" && sudo -E env TALOSCONFIG="$STATE/talosconfig" \
|
||||
"$TALOSCTL" cluster destroy --name "$NAME" --provisioner qemu >/dev/null 2>&1) || true
|
||||
fi
|
||||
if [ "$MODE" = all ] && [ "$STATE_OWNED" = true ]; then
|
||||
sudo rm -rf "$STATE" || true
|
||||
fi
|
||||
exit "$rc"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
start_local_git_server() {
|
||||
GIT_SERVER_CONTAINER="$NAME-git"
|
||||
docker run --detach --rm --name "$GIT_SERVER_CONTAINER" \
|
||||
--publish "$GIT_PORT:23232" \
|
||||
--env SOFT_SERVE_GIT_ENABLED=false \
|
||||
--env SOFT_SERVE_LFS_ENABLED=false \
|
||||
--env SOFT_SERVE_SSH_LISTEN_ADDR=127.0.0.1:23231 \
|
||||
--env SOFT_SERVE_STATS_ENABLED=false \
|
||||
--entrypoint /bin/sh \
|
||||
ghcr.io/charmbracelet/soft-serve:v0.11.6 \
|
||||
-c 'set -eu; ssh-keygen -q -t ed25519 -N "" -f /tmp/admin; export SOFT_SERVE_INITIAL_ADMIN_KEYS="$(cat /tmp/admin.pub)"; /usr/local/bin/soft serve & pid=$!; until ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost settings anon-access read-write; do sleep 1; done; ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost repo create repo; wait "$pid"' \
|
||||
>/dev/null
|
||||
deadline=$((SECONDS + 60))
|
||||
until git ls-remote "$GIT_PUSH_URL" >/dev/null 2>&1; do
|
||||
if (( SECONDS >= deadline )); then
|
||||
just log fatal "Soft Serve is not reachable"
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
}
|
||||
|
||||
prepare() {
|
||||
# In CI the action itself waits for every node's maintenance API before
|
||||
# returning, so the poll here covers only the local path, where cluster
|
||||
# create returns as soon as the VMs launch.
|
||||
if [ "$PROVISIONED" = false ]; then
|
||||
echo "==> booting maintenance-mode nodes"
|
||||
(cd "$STATE" && sudo -E env TALOSCONFIG="$STATE/talosconfig" \
|
||||
"$TALOSCTL" cluster create qemu --name "$NAME" --presets iso,maintenance \
|
||||
--controlplanes 1 --workers 1 --cidr "$CIDR" \
|
||||
--memory-controlplanes 4GiB --memory-workers 3GiB)
|
||||
|
||||
echo "==> waiting for the maintenance API"
|
||||
for ip in "${NODES[@]}"; do
|
||||
until talosctl -n "$ip" get links --insecure >/dev/null 2>&1; do sleep 5; done
|
||||
done
|
||||
fi
|
||||
|
||||
echo "==> discovering node hardware"
|
||||
declare -A MACS DISKS
|
||||
for ip in "${NODES[@]}"; do
|
||||
MACS[$ip]="$(talosctl -n "$ip" get links --insecure -o json \
|
||||
| jq -r 'select(.spec.type == "ether" and .spec.operationalState == "up" and (.metadata.id | startswith("bond") | not)) | .spec.hardwareAddr' | head -1)"
|
||||
DISKS[$ip]="/dev/$(talosctl -n "$ip" get disks --insecure -o json \
|
||||
| jq -r 'select(.spec.readonly == false and (.metadata.id | startswith("loop") | not)) | .metadata.id' | head -1)"
|
||||
echo " $ip mac=${MACS[$ip]} disk=${DISKS[$ip]}"
|
||||
done
|
||||
|
||||
echo "==> generating cluster.toml"
|
||||
export E2E_CIDR="$CIDR"
|
||||
export E2E_GATEWAY="${E2E_GATEWAY:-$PREFIX.1}"
|
||||
export E2E_GIT_HOST="$GIT_HOST"
|
||||
export E2E_GIT_PORT="$GIT_PORT"
|
||||
export E2E_PREFIX="$PREFIX"
|
||||
export E2E_SCHEMATIC="$SCHEMATIC"
|
||||
envsubst '${E2E_CIDR} ${E2E_GATEWAY} ${E2E_GIT_HOST} ${E2E_GIT_PORT} ${E2E_PREFIX} ${E2E_SCHEMATIC}' \
|
||||
< "$E2E_DIR/cluster.toml.tmpl" > cluster.toml
|
||||
index=0
|
||||
for ip in "${NODES[@]}"; do
|
||||
controller=false
|
||||
for cp in "${CONTROLPLANES[@]}"; do [ "$ip" = "$cp" ] && controller=true; done
|
||||
export E2E_NODE_NAME="e2e-$index"
|
||||
export E2E_NODE_ADDRESS="$ip"
|
||||
export E2E_NODE_CONTROLLER="$controller"
|
||||
export E2E_NODE_DISK="${DISKS[$ip]}"
|
||||
export E2E_NODE_MAC="${MACS[$ip]}"
|
||||
envsubst '${E2E_NODE_ADDRESS} ${E2E_NODE_CONTROLLER} ${E2E_NODE_DISK} ${E2E_NODE_MAC} ${E2E_NODE_NAME}' \
|
||||
< "$E2E_DIR/node.toml.tmpl" >> cluster.toml
|
||||
index=$((index + 1))
|
||||
done
|
||||
|
||||
echo "==> configure"
|
||||
just init
|
||||
just configure
|
||||
|
||||
# Flux's FluxInstance only reports Ready once its Git sync succeeds, so the
|
||||
# rendered kubernetes/ tree is committed to a bare repo and served to the
|
||||
# cluster — the same push-then-bootstrap flow the README walks users through.
|
||||
echo "==> publishing rendered repo"
|
||||
mkdir -p "$STATE/gitwork"
|
||||
cp -r kubernetes "$STATE/gitwork/"
|
||||
git -C "$STATE/gitwork" init --quiet --initial-branch main
|
||||
git -C "$STATE/gitwork" add --all
|
||||
git -C "$STATE/gitwork" -c user.name=e2e -c user.email=e2e@cluster.local \
|
||||
commit --quiet --message "rendered workspace"
|
||||
git -C "$STATE/gitwork" push --quiet "$GIT_PUSH_URL" main
|
||||
}
|
||||
|
||||
assert_cluster_health() {
|
||||
echo "==> asserting cluster health"
|
||||
kubectl wait nodes --all --for=condition=Ready --timeout=10m
|
||||
for ns in kube-system cert-manager flux-system; do
|
||||
kubectl wait pods --namespace "$ns" --all --for=condition=Ready --timeout=10m
|
||||
done
|
||||
|
||||
echo "==> asserting flux reconciliation"
|
||||
kubectl wait fluxinstance/flux --namespace flux-system --for=condition=Ready --timeout=10m
|
||||
kubectl wait gitrepositories --all --all-namespaces --for=condition=Ready --timeout=5m
|
||||
kubectl wait kustomizations --all --all-namespaces --for=condition=Ready --timeout=10m
|
||||
kubectl wait helmreleases --all --all-namespaces --for=condition=Ready --timeout=10m
|
||||
}
|
||||
|
||||
foundation() {
|
||||
deadline=$((SECONDS + 60))
|
||||
until git ls-remote "http://$GIT_HOST:$GIT_PORT/repo.git" >/dev/null 2>&1; do
|
||||
if (( SECONDS >= deadline )); then
|
||||
just log fatal "Rendered repository server is not reachable"
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
echo "==> bootstrap talos"
|
||||
just bootstrap talos
|
||||
|
||||
echo "==> bootstrap apps"
|
||||
just bootstrap apps
|
||||
assert_cluster_health
|
||||
|
||||
echo "==> asserting bootstrap idempotency"
|
||||
just configure
|
||||
just bootstrap talos
|
||||
just bootstrap apps
|
||||
assert_cluster_health
|
||||
}
|
||||
|
||||
flux_sops() {
|
||||
echo "==> asserting Flux SOPS decryption"
|
||||
SOPS_SECRET="$STATE/gitwork/kubernetes/apps/default/e2e-sops.sops.yaml"
|
||||
export E2E_SOPS_VALUE=flux-decrypted
|
||||
envsubst '${E2E_SOPS_VALUE}' < "$E2E_DIR/sops-secret.yaml.tmpl" > "$SOPS_SECRET"
|
||||
sops encrypt --filename-override kubernetes/apps/default/e2e-sops.sops.yaml \
|
||||
--in-place "$SOPS_SECRET"
|
||||
yq --inplace '.resources += ["./e2e-sops.sops.yaml"]' \
|
||||
"$STATE/gitwork/kubernetes/apps/default/kustomization.yaml"
|
||||
git -C "$STATE/gitwork" add --all
|
||||
git -C "$STATE/gitwork" -c user.name=e2e -c user.email=e2e@cluster.local \
|
||||
commit --quiet --message "test Flux SOPS decryption"
|
||||
git -C "$STATE/gitwork" push --quiet "$GIT_PUSH_URL" main
|
||||
flux reconcile kustomization cluster-apps --with-source --timeout=10m
|
||||
test "$(kubectl get secret e2e-sops --namespace default \
|
||||
--output jsonpath='{.data.value}' | base64 --decode)" = "flux-decrypted"
|
||||
}
|
||||
|
||||
networking() {
|
||||
echo "==> asserting pod networking and DNS"
|
||||
export E2E_CONTROLPLANE_NODE="$(kubectl get nodes \
|
||||
--selector=node-role.kubernetes.io/control-plane \
|
||||
--output jsonpath='{.items[0].metadata.name}')"
|
||||
export E2E_WORKER_NODE="$(kubectl get nodes \
|
||||
--selector='!node-role.kubernetes.io/control-plane' \
|
||||
--output jsonpath='{.items[0].metadata.name}')"
|
||||
NETWORK_CONFIG="$STATE/network.yaml"
|
||||
envsubst '${E2E_CONTROLPLANE_NODE} ${E2E_WORKER_NODE}' \
|
||||
< "$E2E_DIR/network.yaml.tmpl" > "$NETWORK_CONFIG"
|
||||
kubectl apply --filename "$NETWORK_CONFIG"
|
||||
kubectl wait pods/e2e-network-server pods/e2e-network-client \
|
||||
--namespace default --for=condition=Ready --timeout=5m
|
||||
SERVER_IP="$(kubectl get pod e2e-network-server --namespace default \
|
||||
--output jsonpath='{.status.podIP}')"
|
||||
kubectl exec --namespace default e2e-network-client -- \
|
||||
/agnhost connect --timeout=10s "$SERVER_IP:8080"
|
||||
kubectl exec --namespace default e2e-network-client -- \
|
||||
/agnhost connect --timeout=10s e2e-network-server.default.svc.cluster.local:8080
|
||||
kubectl exec --namespace default e2e-network-client -- \
|
||||
/agnhost connect --timeout=10s github.com:443
|
||||
kubectl apply --filename "$E2E_DIR/cilium-network-policy.yaml"
|
||||
deadline=$((SECONDS + 60))
|
||||
while kubectl exec --namespace default e2e-network-client -- \
|
||||
/agnhost connect --timeout=2s "$SERVER_IP:8080" &>/dev/null; do
|
||||
if (( SECONDS >= deadline )); then
|
||||
just log fatal "CiliumNetworkPolicy did not block pod traffic"
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
kubectl delete ciliumnetworkpolicy e2e-deny-server --namespace default
|
||||
deadline=$((SECONDS + 60))
|
||||
until kubectl exec --namespace default e2e-network-client -- \
|
||||
/agnhost connect --timeout=2s "$SERVER_IP:8080" &>/dev/null; do
|
||||
if (( SECONDS >= deadline )); then
|
||||
just log fatal "Pod traffic did not recover after removing CiliumNetworkPolicy"
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
}
|
||||
|
||||
summary() {
|
||||
kubectl get nodes --output wide
|
||||
kubectl get kustomizations,helmreleases --all-namespaces
|
||||
echo "==> e2e bootstrap succeeded"
|
||||
}
|
||||
|
||||
case "$MODE" in
|
||||
prepare) prepare ;;
|
||||
foundation) foundation ;;
|
||||
flux-sops) flux_sops ;;
|
||||
networking) networking ;;
|
||||
summary) summary ;;
|
||||
all)
|
||||
start_local_git_server
|
||||
prepare
|
||||
foundation
|
||||
flux_sops
|
||||
networking
|
||||
summary
|
||||
;;
|
||||
*)
|
||||
echo "usage: $0 {prepare|foundation|flux-sops|networking|summary|all}" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
@@ -1,22 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "${E2E_CIDR}"
|
||||
default_gateway = "${E2E_GATEWAY}"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "${E2E_PREFIX}.100"
|
||||
|
||||
[gateways]
|
||||
internal = "${E2E_PREFIX}.101"
|
||||
dns = "${E2E_PREFIX}.102"
|
||||
|
||||
[domain]
|
||||
name = "e2e.example.com"
|
||||
|
||||
[dns]
|
||||
provider = "none"
|
||||
|
||||
[repository]
|
||||
url = "http://${E2E_GIT_HOST}:${E2E_GIT_PORT}/repo.git"
|
||||
|
||||
[talos]
|
||||
schematic_id = "${E2E_SCHEMATIC}"
|
||||
@@ -1,42 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: e2e-network-server
|
||||
namespace: default
|
||||
labels:
|
||||
app: e2e-network-server
|
||||
spec:
|
||||
nodeName: "${E2E_WORKER_NODE}"
|
||||
containers:
|
||||
- name: server
|
||||
image: registry.k8s.io/e2e-test-images/agnhost:2.66.0
|
||||
args: ["netexec", "--http-port=8080"]
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: e2e-network-server
|
||||
namespace: default
|
||||
spec:
|
||||
selector:
|
||||
app: e2e-network-server
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: http
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: e2e-network-client
|
||||
namespace: default
|
||||
spec:
|
||||
nodeName: "${E2E_CONTROLPLANE_NODE}"
|
||||
containers:
|
||||
- name: client
|
||||
image: registry.k8s.io/e2e-test-images/agnhost:2.66.0
|
||||
args: ["pause"]
|
||||
@@ -1,7 +0,0 @@
|
||||
|
||||
[[nodes]]
|
||||
name = "${E2E_NODE_NAME}"
|
||||
address = "${E2E_NODE_ADDRESS}"
|
||||
controller = ${E2E_NODE_CONTROLLER}
|
||||
disk = "${E2E_NODE_DISK}"
|
||||
mac_addr = "${E2E_NODE_MAC}"
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: e2e-sops
|
||||
namespace: default
|
||||
stringData:
|
||||
value: "${E2E_SOPS_VALUE}"
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://raw.githubusercontent.com/home-operations/talosctl-cluster-action/main/schema/talos-cluster.json
|
||||
# Maintenance-mode nodes for the bootstrap e2e: the action boots and destroys
|
||||
# them, and cluster.sh exercises the template's real bootstrap flow against
|
||||
# the unconfigured nodes.
|
||||
apiVersion: v1alpha1
|
||||
kind: TalosCluster
|
||||
metadata:
|
||||
name: template-e2e
|
||||
spec:
|
||||
controlplanes:
|
||||
count: 1
|
||||
memory: 4GiB
|
||||
workers:
|
||||
count: 1
|
||||
memory: 3GiB
|
||||
network:
|
||||
cidr: 10.9.0.0/24
|
||||
qemu:
|
||||
presets: [iso, maintenance]
|
||||
disks: [virtio:10GiB]
|
||||
@@ -1,34 +0,0 @@
|
||||
# Negative fixture: BGP router ASN above the 32-bit ASN range.
|
||||
# Expected to be rejected by _router_asn_in_range.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[cilium.bgp]
|
||||
router_addr = "10.10.1.1"
|
||||
router_asn = "4294967296"
|
||||
node_asn = "64514"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: malformed MAC address (uppercase + missing colons).
|
||||
# Expected to be rejected by the #Node.mac_addr regex constraint.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "AABBCCDDEEFF"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,30 +0,0 @@
|
||||
# Negative fixture: scp-style git URL ("git@host:owner/repo.git") instead of
|
||||
# the canonical https:// or ssh://git@ form.
|
||||
# Expected to be rejected by the repository.url pattern.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "git@github.com:onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,30 +0,0 @@
|
||||
# Negative fixture: vlan_tag outside the valid 1-4094 range.
|
||||
# Expected to be rejected by _vlan_tag_in_range.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
vlan_tag = "5000"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: gateways.internal == gateways.dns.
|
||||
# Expected to be rejected by `_addrs_check` (list.UniqueItems).
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.252"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,37 +0,0 @@
|
||||
# Negative fixture: two nodes with the same name.
|
||||
# Expected to be rejected by `_node_name_check` (list.UniqueItems).
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: a node reuses the internal gateway VIP.
|
||||
# Expected to be rejected by _addr_uniqueness_check.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.252"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: dns.provider "cloudflare" (the default) without a token.
|
||||
# Expected to be rejected by the Dns validator.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
provider = "cloudflare"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,28 +0,0 @@
|
||||
# Negative fixture: cloudflare-tunnel ingress without gateways.external.
|
||||
# Expected to be rejected by the Config cross-check.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,30 +0,0 @@
|
||||
# Negative fixture: ssh:// URL to a host without bundled SSH host keys
|
||||
# (github.com/gitlab.com/codeberg.org) and no repository.known_hosts set.
|
||||
# Expected to be rejected by the conditional known_hosts constraint.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "ssh://git@git.example.com/k8s/home-ops.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,28 +0,0 @@
|
||||
# Negative fixture: a node without schematic_id and no [talos] default.
|
||||
# Expected to be rejected by the schematic resolution in Config.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
@@ -1,30 +0,0 @@
|
||||
# Negative fixture: node_cidr is nested inside the default pod_cidr
|
||||
# (10.42.0.0/16) without being string-equal to it.
|
||||
# Expected to be rejected by _cidr_overlap_check.
|
||||
[network]
|
||||
node_cidr = "10.42.128.0/17"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.42.128.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.42.128.252"
|
||||
dns = "10.42.128.253"
|
||||
external = "10.42.128.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.42.128.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: node address is not inside network.node_cidr.
|
||||
# Expected to be rejected by _node_addrs_in_node_cidr.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "192.168.1.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,30 +0,0 @@
|
||||
# Negative fixture: a node claims the default gateway address (defaults to
|
||||
# the first IP in node_cidr).
|
||||
# Expected to be rejected by _addr_uniqueness_check.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.1"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,30 +0,0 @@
|
||||
# Negative fixture: node_cidr written with host bits set instead of the
|
||||
# network address.
|
||||
# Expected to be rejected by _cidr_canonical_check.
|
||||
[network]
|
||||
node_cidr = "10.10.10.5/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: network.node_cidr overlaps the default kubernetes.pod_cidr (10.42.0.0/16).
|
||||
# Expected to be rejected by `_cidrs_check` (list.UniqueItems).
|
||||
[network]
|
||||
node_cidr = "10.42.0.0/16"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.42.0.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.42.0.252"
|
||||
dns = "10.42.0.253"
|
||||
external = "10.42.0.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.42.0.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,34 +0,0 @@
|
||||
# Negative fixture: two of the three BGP fields set; previously this
|
||||
# silently left BGP disabled.
|
||||
# Expected to be rejected by the Bgp all-or-nothing check.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[cilium.bgp]
|
||||
router_addr = "10.10.1.1"
|
||||
router_asn = "64513"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,29 +0,0 @@
|
||||
# Negative fixture: a node name uses the reserved word "controller".
|
||||
# Expected to be rejected by the #Node.name regex constraint.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "controller"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,33 +0,0 @@
|
||||
# Negative fixture: svc_cidr too small to contain the derived CoreDNS
|
||||
# address (10th IP).
|
||||
# Expected to be rejected by _coredns_addr_in_svc_cidr.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes]
|
||||
svc_cidr = "10.43.0.0/29"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,32 +0,0 @@
|
||||
# Negative fixture: cloudflare-tunnel ingress with dns.provider "none".
|
||||
# Expected to be rejected by the Config cross-check.
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
provider = "none"
|
||||
|
||||
[ingress]
|
||||
mode = "cloudflare-tunnel"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,38 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[ingress]
|
||||
mode = "direct"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,34 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
provider = "none"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,42 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
|
||||
[repository]
|
||||
url = "ssh://git@github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
provider = "none"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-2"
|
||||
address = "10.10.10.102"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:02"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,36 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
webhook_provider = "none"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,39 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "ssh://git@github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
mtu = 1500
|
||||
secureboot = true
|
||||
encrypt_disk = true
|
||||
kernel_modules = ["nvidia", "nvidia_uvm"]
|
||||
@@ -1,59 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
default_gateway = "10.10.10.1"
|
||||
vlan_tag = "100"
|
||||
dns_servers = ["1.1.1.1"]
|
||||
ntp_servers = ["162.159.200.123"]
|
||||
|
||||
[kubernetes]
|
||||
pod_cidr = "10.42.0.0/16"
|
||||
svc_cidr = "10.43.0.0/16"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
tls_sans = ["example.com"]
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
branch = "main"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[cilium]
|
||||
loadbalancer_mode = "dsr"
|
||||
|
||||
[cilium.bgp]
|
||||
router_addr = "10.10.1.1"
|
||||
router_asn = "64513"
|
||||
node_asn = "64514"
|
||||
|
||||
[talos]
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
mtu = 1500
|
||||
secureboot = true
|
||||
encrypt_disk = true
|
||||
kernel_modules = ["nvidia", "nvidia_uvm"]
|
||||
@@ -1,39 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
external = "10.10.10.251"
|
||||
|
||||
[repository]
|
||||
url = "ssh://git@git.example.com/k8s/home-ops.git"
|
||||
webhook_provider = "generic-hmac"
|
||||
known_hosts = """
|
||||
git.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
"""
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
token = "fake"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-1"
|
||||
address = "10.10.10.101"
|
||||
controller = false
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:01"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,26 +0,0 @@
|
||||
[network]
|
||||
node_cidr = "10.10.10.0/24"
|
||||
|
||||
[kubernetes.api]
|
||||
addr = "10.10.10.254"
|
||||
|
||||
[gateways]
|
||||
internal = "10.10.10.252"
|
||||
dns = "10.10.10.253"
|
||||
|
||||
[domain]
|
||||
name = "example.com"
|
||||
|
||||
[dns]
|
||||
provider = "none"
|
||||
|
||||
[repository]
|
||||
url = "https://github.com/onedr0p/cluster-template.git"
|
||||
|
||||
[[nodes]]
|
||||
name = "k8s-0"
|
||||
address = "10.10.10.100"
|
||||
controller = true
|
||||
disk = "/dev/sdfake"
|
||||
mac_addr = "00:00:00:00:00:00"
|
||||
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
|
||||
@@ -1,103 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||
name: "E2E Cluster"
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
branches: ["main"]
|
||||
schedule:
|
||||
- cron: "30 5 * * *"
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
bootstrap:
|
||||
if: ${{ github.repository == 'onedr0p/cluster-template' }}
|
||||
name: bootstrap (qemu)
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
services:
|
||||
git:
|
||||
image: ghcr.io/charmbracelet/soft-serve:v0.12.2
|
||||
env:
|
||||
SOFT_SERVE_GIT_ENABLED: "false"
|
||||
SOFT_SERVE_LFS_ENABLED: "false"
|
||||
SOFT_SERVE_SSH_LISTEN_ADDR: "127.0.0.1:23231"
|
||||
SOFT_SERVE_STATS_ENABLED: "false"
|
||||
ports:
|
||||
- 8418:23232
|
||||
entrypoint: /bin/sh
|
||||
command: >-
|
||||
-c "set -eu; ssh-keygen -q -t ed25519 -N '' -f /tmp/admin;
|
||||
export SOFT_SERVE_INITIAL_ADMIN_KEYS=$(cat /tmp/admin.pub);
|
||||
/usr/local/bin/soft serve & pid=$!;
|
||||
until ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost settings anon-access read-write; do sleep 1; done;
|
||||
ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost repo create repo;
|
||||
wait $pid"
|
||||
options: >-
|
||||
--health-cmd "git ls-remote http://localhost:23232/repo.git"
|
||||
--health-interval 2s
|
||||
--health-timeout 2s
|
||||
--health-retries 30
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install QEMU
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install --yes --no-install-recommends gettext-base qemu-system-x86 qemu-utils ovmf
|
||||
|
||||
- name: Setup mise
|
||||
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: Boot maintenance-mode nodes
|
||||
id: cluster
|
||||
uses: home-operations/talosctl-cluster-action@fb6a31bf5de43218acc80d2e23958a16eee7380c # v0.2.2
|
||||
with:
|
||||
config: ./.github/template-tests/e2e/talos-cluster.yaml
|
||||
cache: true
|
||||
|
||||
- name: Export cluster environment
|
||||
env:
|
||||
CONTROLPLANE_IPS: "${{ steps.cluster.outputs.controlplane-ips }}"
|
||||
GATEWAY: "${{ steps.cluster.outputs.gateway }}"
|
||||
WORKER_IPS: "${{ steps.cluster.outputs.worker-ips }}"
|
||||
run: |
|
||||
echo "E2E_CONTROLPLANE_IPS=$CONTROLPLANE_IPS" >> "$GITHUB_ENV"
|
||||
echo "E2E_WORKER_IPS=$WORKER_IPS" >> "$GITHUB_ENV"
|
||||
echo "E2E_GATEWAY=$GATEWAY" >> "$GITHUB_ENV"
|
||||
echo "E2E_CIDR=10.9.0.0/24" >> "$GITHUB_ENV"
|
||||
echo "E2E_STATE=$RUNNER_TEMP/template-e2e" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Prepare cluster
|
||||
run: bash ./.github/template-tests/e2e/cluster.sh prepare
|
||||
|
||||
- name: Build healthy cluster foundation
|
||||
run: bash ./.github/template-tests/e2e/cluster.sh foundation
|
||||
|
||||
- name: Test Flux SOPS
|
||||
id: flux-sops
|
||||
run: bash ./.github/template-tests/e2e/cluster.sh flux-sops
|
||||
background: true
|
||||
|
||||
- name: Test networking
|
||||
id: networking
|
||||
run: bash ./.github/template-tests/e2e/cluster.sh networking
|
||||
background: true
|
||||
|
||||
- name: Wait for E2E tests
|
||||
wait: [flux-sops, networking]
|
||||
|
||||
- name: Summarize cluster
|
||||
run: bash ./.github/template-tests/e2e/cluster.sh summary
|
||||
@@ -1,176 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||
name: "E2E"
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
validate-invalid:
|
||||
if: ${{ github.repository == 'onedr0p/cluster-template' }}
|
||||
name: reject-invalid (${{ matrix.fixture }})
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
fixture:
|
||||
- overlapping-cidrs
|
||||
- nested-cidr-overlap
|
||||
- non-canonical-cidr
|
||||
- tiny-svc-cidr
|
||||
- duplicate-gateway-addrs
|
||||
- duplicate-node-names
|
||||
- reserved-node-name
|
||||
- bad-mac-address
|
||||
- bad-repo-url
|
||||
- missing-known-hosts
|
||||
- node-addr-outside-cidr
|
||||
- node-uses-gateway-addr
|
||||
- gateway-node-collision
|
||||
- bad-vlan-tag
|
||||
- bad-bgp-asn
|
||||
- missing-dns-token
|
||||
- tunnel-without-dns
|
||||
- missing-external-gateway
|
||||
- missing-schematic
|
||||
- partial-bgp
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup mise
|
||||
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: Assert schema rejects ${{ matrix.fixture }}.toml
|
||||
run: |
|
||||
fixture=./.github/template-tests/invalid/${{ matrix.fixture }}.toml
|
||||
if uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" >/dev/null 2>&1; then
|
||||
echo "::error::schema accepted invalid fixture ${{ matrix.fixture }} (expected rejection)"
|
||||
exit 1
|
||||
fi
|
||||
echo "schema correctly rejected ${{ matrix.fixture }}"
|
||||
# Also surface the actual error message in the log for debuggability.
|
||||
uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" || true
|
||||
|
||||
validator-tests:
|
||||
if: ${{ github.repository == 'onedr0p/cluster-template' }}
|
||||
name: validator-tests
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup mise
|
||||
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
|
||||
env:
|
||||
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: Run validator tests
|
||||
run: uv run --quiet --locked pytest ./template/scripts/test_validate.py
|
||||
|
||||
validate-valid:
|
||||
if: ${{ github.repository == 'onedr0p/cluster-template' }}
|
||||
name: accept-valid (${{ matrix.fixture }})
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
fixture:
|
||||
- public
|
||||
- private
|
||||
- selfhosted
|
||||
- no-webhook
|
||||
- internal
|
||||
- direct
|
||||
- single-node
|
||||
- multi-controller
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Setup mise
|
||||
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
|
||||
with:
|
||||
experimental: true
|
||||
install_args: --locked
|
||||
|
||||
- name: Run init recipe
|
||||
run: just init
|
||||
|
||||
- name: Prepare files
|
||||
run: |
|
||||
cp ./.github/template-tests/valid/${{ matrix.fixture }}.toml cluster.toml
|
||||
echo '{"AccountTag":"fake","TunnelSecret":"fake","TunnelID":"fake"}' > cloudflare-tunnel.json
|
||||
touch kubeconfig
|
||||
|
||||
- name: Assert cluster.toml passes the JSON Schema
|
||||
run: taplo check --schema "file://$PWD/cluster.schema.json" ./cluster.toml
|
||||
|
||||
- name: Run configure recipe
|
||||
run: just configure
|
||||
|
||||
# Rendered output must already match the format-yaml pre-commit hook,
|
||||
# otherwise every `just configure` shows up as formatting churn.
|
||||
- name: Assert rendered output is formatted
|
||||
run: oxfmt --check ./.sops.yaml ./bootstrap ./kubernetes ./talos
|
||||
|
||||
- name: Install flate
|
||||
uses: home-operations/flate/action@631b76b69c4e58c6f4d1cb01e23616fa61aebafa # v0.6.5
|
||||
with:
|
||||
base: ""
|
||||
|
||||
- name: Run flate test
|
||||
run: flate test all -p ./kubernetes/flux/cluster
|
||||
|
||||
- name: Render bootstrap helmfile charts
|
||||
run: just template test-helmfile
|
||||
|
||||
- name: Dry run bootstrap talos recipe
|
||||
run: just --dry-run bootstrap talos
|
||||
|
||||
- name: Create talos secret
|
||||
run: just bootstrap talos-secret
|
||||
|
||||
- name: Render talos configs
|
||||
run: just talos render
|
||||
|
||||
- name: Validate talos configs
|
||||
run: |
|
||||
for config in ./talos/rendered/*.yaml; do
|
||||
talosctl validate --config "$config" --mode metal
|
||||
done
|
||||
|
||||
- name: Dry run bootstrap apps recipe
|
||||
run: just --dry-run bootstrap apps
|
||||
|
||||
- name: Run reset recipe
|
||||
run: yes | just template reset
|
||||
|
||||
- name: Run tidy recipe
|
||||
run: yes | just template tidy
|
||||
@@ -1,58 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||
name: "Release"
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
- cron: 0 0 1 * *
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
release:
|
||||
name: Release
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
steps:
|
||||
- name: Get Previous Release Tag and Determine Next Tag
|
||||
id: determine-next-tag
|
||||
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
||||
with:
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
result-encoding: string
|
||||
script: |
|
||||
const { data: releases } = await github.rest.repos.listReleases({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
per_page: 1,
|
||||
});
|
||||
|
||||
let previousTag = "0.0.0"; // Default if no previous release exists
|
||||
if (releases.length > 0) {
|
||||
previousTag = releases[0].tag_name;
|
||||
}
|
||||
|
||||
const [previousMajor, previousMinor, previousPatch] = previousTag.split('.').map(Number);
|
||||
const currentYear = new Date().getFullYear();
|
||||
const currentMonth = new Date().getMonth() + 1; // Months are 0-indexed in JavaScript
|
||||
|
||||
const nextMajorMinor = `${currentYear}.${currentMonth}`;
|
||||
let nextPatch;
|
||||
|
||||
if (`${previousMajor}.${previousMinor}` === nextMajorMinor) {
|
||||
console.log("Month release already exists for the year. Incrementing patch number by 1.");
|
||||
nextPatch = previousPatch + 1;
|
||||
} else {
|
||||
console.log("Month release does not exist for the year. Starting with patch number 0.");
|
||||
nextPatch = 0;
|
||||
}
|
||||
|
||||
return `${nextMajorMinor}.${nextPatch}`;
|
||||
|
||||
- name: Create Release
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
TAG: ${{ steps.determine-next-tag.outputs.result }}
|
||||
run: gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --generate-notes
|
||||
Reference in New Issue
Block a user