grachevko/home-ops
1
0
Fork 0
Code Issues Pull Requests 1 Actions 13 Packages Projects Releases Wiki Activity

chore: tidy up 🧹

Browse Source
This commit is contained in:
grachevko
2026-09-16 23:12:48 +03:00
parent 3d5f56f099
commit 6b1fc54c0d
156 changed files with 0 additions and 6158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/template-tests/e2e/cilium-network-policy.yaml
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: e2e-deny-server
namespace: default
spec:
endpointSelector:
matchLabels:
app: e2e-network-server
ingress:
- {}
.github/template-tests/e2e/cluster.sh
-291
View File
@@ -1,291 +0,0 @@
#!/usr/bin/env bash
# Full-fidelity bootstrap e2e: takes maintenance-mode Talos VMs, discovers
# their hardware the same way the README instructs users to, writes a
# cluster.toml from the discovered facts, and runs the template's real
# bootstrap flow against them.
#
# Two provisioning paths share this test body:
# - CI: talosctl-cluster-action boots the nodes (talos-cluster.yaml) and
# passes E2E_CONTROLPLANE_IPS / E2E_WORKER_IPS / E2E_CIDR; the action's
# post step destroys them.
# - Local: run with no env set; the script boots and destroys the cluster
# itself. Requires Docker, /dev/kvm, passwordless sudo, qemu-system-x86,
# and the repo's mise toolchain on PATH.
#
# Renders into the working tree like any configure run.
set -euo pipefail
NAME="${E2E_NAME:-template-e2e}"
MODE="${1:-all}"
E2E_DIR=".github/template-tests/e2e"
CIDR="${E2E_CIDR:-10.9.0.0/24}"
PREFIX="${CIDR%/*}"
PREFIX="${PREFIX%.*}"
TALOSCTL="$(command -v talosctl)"
# The Image Factory vanilla schematic, matching the ISO the nodes boot from.
SCHEMATIC="376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
if [ -n "${E2E_CONTROLPLANE_IPS:-}" ]; then
PROVISIONED=true
IFS=',' read -r -a CONTROLPLANES <<< "$E2E_CONTROLPLANE_IPS"
IFS=',' read -r -a WORKERS <<< "${E2E_WORKER_IPS:-}"
else
PROVISIONED=false
CONTROLPLANES=("$PREFIX.2")
WORKERS=("$PREFIX.3")
fi
NODES=("${CONTROLPLANES[@]}" "${WORKERS[@]}")
# The VMs reach the host at the gateway address; the rendered workspace is
# served from there over git smart HTTP so Flux can sync it.
GIT_HOST="${E2E_GATEWAY:-$PREFIX.1}"
GIT_PORT=8418
GIT_SERVER_CONTAINER=""
# The provisioner runs under sudo and writes state relative to its cwd and
# TALOSCONFIG, so both are pointed at a scratch dir to keep root-owned files
# out of the repo.
if [ -n "${E2E_STATE:-}" ]; then
STATE="$E2E_STATE"
STATE_OWNED=false
else
STATE="$(mktemp -d)"
STATE_OWNED=true
fi
mkdir -p "$STATE"
GIT_PUSH_URL="http://127.0.0.1:$GIT_PORT/repo.git"
cleanup() {
rc=$?
if [ "$rc" -ne 0 ]; then
echo "==> e2e failed (rc=$rc), collecting diagnostics"
kubectl get pods --all-namespaces 2>/dev/null || true
kubectl get gitrepositories,kustomizations,helmreleases --all-namespaces 2>/dev/null || true
kubectl get events --all-namespaces --sort-by=.lastTimestamp 2>/dev/null | tail -30 || true
[ -n "$GIT_SERVER_CONTAINER" ] && docker logs --tail 5 "$GIT_SERVER_CONTAINER" 2>/dev/null || true
for ip in "${NODES[@]}"; do
talosctl -n "$ip" dmesg 2>/dev/null | tail -20 || true
done
fi
if [ "$MODE" = all ]; then
[ -n "$GIT_SERVER_CONTAINER" ] && docker stop "$GIT_SERVER_CONTAINER" >/dev/null 2>&1 || true
fi
if [ "$MODE" = all ] && [ "$PROVISIONED" = false ]; then
(cd "$STATE" && sudo -E env TALOSCONFIG="$STATE/talosconfig" \
"$TALOSCTL" cluster destroy --name "$NAME" --provisioner qemu >/dev/null 2>&1) || true
fi
if [ "$MODE" = all ] && [ "$STATE_OWNED" = true ]; then
sudo rm -rf "$STATE" || true
fi
exit "$rc"
}
trap cleanup EXIT
start_local_git_server() {
GIT_SERVER_CONTAINER="$NAME-git"
docker run --detach --rm --name "$GIT_SERVER_CONTAINER" \
--publish "$GIT_PORT:23232" \
--env SOFT_SERVE_GIT_ENABLED=false \
--env SOFT_SERVE_LFS_ENABLED=false \
--env SOFT_SERVE_SSH_LISTEN_ADDR=127.0.0.1:23231 \
--env SOFT_SERVE_STATS_ENABLED=false \
--entrypoint /bin/sh \
ghcr.io/charmbracelet/soft-serve:v0.11.6 \
-c 'set -eu; ssh-keygen -q -t ed25519 -N "" -f /tmp/admin; export SOFT_SERVE_INITIAL_ADMIN_KEYS="$(cat /tmp/admin.pub)"; /usr/local/bin/soft serve & pid=$!; until ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost settings anon-access read-write; do sleep 1; done; ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost repo create repo; wait "$pid"' \
>/dev/null
deadline=$((SECONDS + 60))
until git ls-remote "$GIT_PUSH_URL" >/dev/null 2>&1; do
if (( SECONDS >= deadline )); then
just log fatal "Soft Serve is not reachable"
fi
sleep 1
done
}
prepare() {
# In CI the action itself waits for every node's maintenance API before
# returning, so the poll here covers only the local path, where cluster
# create returns as soon as the VMs launch.
if [ "$PROVISIONED" = false ]; then
echo "==> booting maintenance-mode nodes"
(cd "$STATE" && sudo -E env TALOSCONFIG="$STATE/talosconfig" \
"$TALOSCTL" cluster create qemu --name "$NAME" --presets iso,maintenance \
--controlplanes 1 --workers 1 --cidr "$CIDR" \
--memory-controlplanes 4GiB --memory-workers 3GiB)
echo "==> waiting for the maintenance API"
for ip in "${NODES[@]}"; do
until talosctl -n "$ip" get links --insecure >/dev/null 2>&1; do sleep 5; done
done
fi
echo "==> discovering node hardware"
declare -A MACS DISKS
for ip in "${NODES[@]}"; do
MACS[$ip]="$(talosctl -n "$ip" get links --insecure -o json \
| jq -r 'select(.spec.type == "ether" and .spec.operationalState == "up" and (.metadata.id | startswith("bond") | not)) | .spec.hardwareAddr' | head -1)"
DISKS[$ip]="/dev/$(talosctl -n "$ip" get disks --insecure -o json \
| jq -r 'select(.spec.readonly == false and (.metadata.id | startswith("loop") | not)) | .metadata.id' | head -1)"
echo " $ip mac=${MACS[$ip]} disk=${DISKS[$ip]}"
done
echo "==> generating cluster.toml"
export E2E_CIDR="$CIDR"
export E2E_GATEWAY="${E2E_GATEWAY:-$PREFIX.1}"
export E2E_GIT_HOST="$GIT_HOST"
export E2E_GIT_PORT="$GIT_PORT"
export E2E_PREFIX="$PREFIX"
export E2E_SCHEMATIC="$SCHEMATIC"
envsubst '${E2E_CIDR} ${E2E_GATEWAY} ${E2E_GIT_HOST} ${E2E_GIT_PORT} ${E2E_PREFIX} ${E2E_SCHEMATIC}' \
< "$E2E_DIR/cluster.toml.tmpl" > cluster.toml
index=0
for ip in "${NODES[@]}"; do
controller=false
for cp in "${CONTROLPLANES[@]}"; do [ "$ip" = "$cp" ] && controller=true; done
export E2E_NODE_NAME="e2e-$index"
export E2E_NODE_ADDRESS="$ip"
export E2E_NODE_CONTROLLER="$controller"
export E2E_NODE_DISK="${DISKS[$ip]}"
export E2E_NODE_MAC="${MACS[$ip]}"
envsubst '${E2E_NODE_ADDRESS} ${E2E_NODE_CONTROLLER} ${E2E_NODE_DISK} ${E2E_NODE_MAC} ${E2E_NODE_NAME}' \
< "$E2E_DIR/node.toml.tmpl" >> cluster.toml
index=$((index + 1))
done
echo "==> configure"
just init
just configure
# Flux's FluxInstance only reports Ready once its Git sync succeeds, so the
# rendered kubernetes/ tree is committed to a bare repo and served to the
# cluster — the same push-then-bootstrap flow the README walks users through.
echo "==> publishing rendered repo"
mkdir -p "$STATE/gitwork"
cp -r kubernetes "$STATE/gitwork/"
git -C "$STATE/gitwork" init --quiet --initial-branch main
git -C "$STATE/gitwork" add --all
git -C "$STATE/gitwork" -c user.name=e2e -c user.email=e2e@cluster.local \
commit --quiet --message "rendered workspace"
git -C "$STATE/gitwork" push --quiet "$GIT_PUSH_URL" main
}
assert_cluster_health() {
echo "==> asserting cluster health"
kubectl wait nodes --all --for=condition=Ready --timeout=10m
for ns in kube-system cert-manager flux-system; do
kubectl wait pods --namespace "$ns" --all --for=condition=Ready --timeout=10m
done
echo "==> asserting flux reconciliation"
kubectl wait fluxinstance/flux --namespace flux-system --for=condition=Ready --timeout=10m
kubectl wait gitrepositories --all --all-namespaces --for=condition=Ready --timeout=5m
kubectl wait kustomizations --all --all-namespaces --for=condition=Ready --timeout=10m
kubectl wait helmreleases --all --all-namespaces --for=condition=Ready --timeout=10m
}
foundation() {
deadline=$((SECONDS + 60))
until git ls-remote "http://$GIT_HOST:$GIT_PORT/repo.git" >/dev/null 2>&1; do
if (( SECONDS >= deadline )); then
just log fatal "Rendered repository server is not reachable"
fi
sleep 1
done
echo "==> bootstrap talos"
just bootstrap talos
echo "==> bootstrap apps"
just bootstrap apps
assert_cluster_health
echo "==> asserting bootstrap idempotency"
just configure
just bootstrap talos
just bootstrap apps
assert_cluster_health
}
flux_sops() {
echo "==> asserting Flux SOPS decryption"
SOPS_SECRET="$STATE/gitwork/kubernetes/apps/default/e2e-sops.sops.yaml"
export E2E_SOPS_VALUE=flux-decrypted
envsubst '${E2E_SOPS_VALUE}' < "$E2E_DIR/sops-secret.yaml.tmpl" > "$SOPS_SECRET"
sops encrypt --filename-override kubernetes/apps/default/e2e-sops.sops.yaml \
--in-place "$SOPS_SECRET"
yq --inplace '.resources += ["./e2e-sops.sops.yaml"]' \
"$STATE/gitwork/kubernetes/apps/default/kustomization.yaml"
git -C "$STATE/gitwork" add --all
git -C "$STATE/gitwork" -c user.name=e2e -c user.email=e2e@cluster.local \
commit --quiet --message "test Flux SOPS decryption"
git -C "$STATE/gitwork" push --quiet "$GIT_PUSH_URL" main
flux reconcile kustomization cluster-apps --with-source --timeout=10m
test "$(kubectl get secret e2e-sops --namespace default \
--output jsonpath='{.data.value}' | base64 --decode)" = "flux-decrypted"
}
networking() {
echo "==> asserting pod networking and DNS"
export E2E_CONTROLPLANE_NODE="$(kubectl get nodes \
--selector=node-role.kubernetes.io/control-plane \
--output jsonpath='{.items[0].metadata.name}')"
export E2E_WORKER_NODE="$(kubectl get nodes \
--selector='!node-role.kubernetes.io/control-plane' \
--output jsonpath='{.items[0].metadata.name}')"
NETWORK_CONFIG="$STATE/network.yaml"
envsubst '${E2E_CONTROLPLANE_NODE} ${E2E_WORKER_NODE}' \
< "$E2E_DIR/network.yaml.tmpl" > "$NETWORK_CONFIG"
kubectl apply --filename "$NETWORK_CONFIG"
kubectl wait pods/e2e-network-server pods/e2e-network-client \
--namespace default --for=condition=Ready --timeout=5m
SERVER_IP="$(kubectl get pod e2e-network-server --namespace default \
--output jsonpath='{.status.podIP}')"
kubectl exec --namespace default e2e-network-client -- \
/agnhost connect --timeout=10s "$SERVER_IP:8080"
kubectl exec --namespace default e2e-network-client -- \
/agnhost connect --timeout=10s e2e-network-server.default.svc.cluster.local:8080
kubectl exec --namespace default e2e-network-client -- \
/agnhost connect --timeout=10s github.com:443
kubectl apply --filename "$E2E_DIR/cilium-network-policy.yaml"
deadline=$((SECONDS + 60))
while kubectl exec --namespace default e2e-network-client -- \
/agnhost connect --timeout=2s "$SERVER_IP:8080" &>/dev/null; do
if (( SECONDS >= deadline )); then
just log fatal "CiliumNetworkPolicy did not block pod traffic"
fi
sleep 2
done
kubectl delete ciliumnetworkpolicy e2e-deny-server --namespace default
deadline=$((SECONDS + 60))
until kubectl exec --namespace default e2e-network-client -- \
/agnhost connect --timeout=2s "$SERVER_IP:8080" &>/dev/null; do
if (( SECONDS >= deadline )); then
just log fatal "Pod traffic did not recover after removing CiliumNetworkPolicy"
fi
sleep 2
done
}
summary() {
kubectl get nodes --output wide
kubectl get kustomizations,helmreleases --all-namespaces
echo "==> e2e bootstrap succeeded"
}
case "$MODE" in
prepare) prepare ;;
foundation) foundation ;;
flux-sops) flux_sops ;;
networking) networking ;;
summary) summary ;;
all)
start_local_git_server
prepare
foundation
flux_sops
networking
summary
;;
*)
echo "usage: $0 {prepare|foundation|flux-sops|networking|summary|all}" >&2
exit 2
;;
esac
.github/template-tests/e2e/cluster.toml.tmpl
-22
View File
@@ -1,22 +0,0 @@
[network]
node_cidr = "${E2E_CIDR}"
default_gateway = "${E2E_GATEWAY}"
[kubernetes.api]
addr = "${E2E_PREFIX}.100"
[gateways]
internal = "${E2E_PREFIX}.101"
dns = "${E2E_PREFIX}.102"
[domain]
name = "e2e.example.com"
[dns]
provider = "none"
[repository]
url = "http://${E2E_GIT_HOST}:${E2E_GIT_PORT}/repo.git"
[talos]
schematic_id = "${E2E_SCHEMATIC}"
.github/template-tests/e2e/network.yaml.tmpl
-42
View File
@@ -1,42 +0,0 @@
---
apiVersion: v1
kind: Pod
metadata:
name: e2e-network-server
namespace: default
labels:
app: e2e-network-server
spec:
nodeName: "${E2E_WORKER_NODE}"
containers:
- name: server
image: registry.k8s.io/e2e-test-images/agnhost:2.66.0
args: ["netexec", "--http-port=8080"]
ports:
- name: http
containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
name: e2e-network-server
namespace: default
spec:
selector:
app: e2e-network-server
ports:
- name: http
port: 8080
targetPort: http
---
apiVersion: v1
kind: Pod
metadata:
name: e2e-network-client
namespace: default
spec:
nodeName: "${E2E_CONTROLPLANE_NODE}"
containers:
- name: client
image: registry.k8s.io/e2e-test-images/agnhost:2.66.0
args: ["pause"]
.github/template-tests/e2e/node.toml.tmpl
-7
View File
@@ -1,7 +0,0 @@
[[nodes]]
name = "${E2E_NODE_NAME}"
address = "${E2E_NODE_ADDRESS}"
controller = ${E2E_NODE_CONTROLLER}
disk = "${E2E_NODE_DISK}"
mac_addr = "${E2E_NODE_MAC}"
.github/template-tests/e2e/sops-secret.yaml.tmpl
-8
View File
@@ -1,8 +0,0 @@
---
apiVersion: v1
kind: Secret
metadata:
name: e2e-sops
namespace: default
stringData:
value: "${E2E_SOPS_VALUE}"
.github/template-tests/e2e/talos-cluster.yaml
-21
View File
@@ -1,21 +0,0 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/home-operations/talosctl-cluster-action/main/schema/talos-cluster.json
# Maintenance-mode nodes for the bootstrap e2e: the action boots and destroys
# them, and cluster.sh exercises the template's real bootstrap flow against
# the unconfigured nodes.
apiVersion: v1alpha1
kind: TalosCluster
metadata:
name: template-e2e
spec:
controlplanes:
count: 1
memory: 4GiB
workers:
count: 1
memory: 3GiB
network:
cidr: 10.9.0.0/24
qemu:
presets: [iso, maintenance]
disks: [virtio:10GiB]
.github/template-tests/invalid/bad-bgp-asn.toml
-34
View File
@@ -1,34 +0,0 @@
# Negative fixture: BGP router ASN above the 32-bit ASN range.
# Expected to be rejected by _router_asn_in_range.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[cilium.bgp]
router_addr = "10.10.1.1"
router_asn = "4294967296"
node_asn = "64514"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/bad-mac-address.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: malformed MAC address (uppercase + missing colons).
# Expected to be rejected by the #Node.mac_addr regex constraint.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "AABBCCDDEEFF"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/bad-repo-url.toml
-30
View File
@@ -1,30 +0,0 @@
# Negative fixture: scp-style git URL ("git@host:owner/repo.git") instead of
# the canonical https:// or ssh://git@ form.
# Expected to be rejected by the repository.url pattern.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "git@github.com:onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/bad-vlan-tag.toml
-30
View File
@@ -1,30 +0,0 @@
# Negative fixture: vlan_tag outside the valid 1-4094 range.
# Expected to be rejected by _vlan_tag_in_range.
[network]
node_cidr = "10.10.10.0/24"
vlan_tag = "5000"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/duplicate-gateway-addrs.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: gateways.internal == gateways.dns.
# Expected to be rejected by `_addrs_check` (list.UniqueItems).
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.252"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/duplicate-node-names.toml
-37
View File
@@ -1,37 +0,0 @@
# Negative fixture: two nodes with the same name.
# Expected to be rejected by `_node_name_check` (list.UniqueItems).
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-0"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/gateway-node-collision.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: a node reuses the internal gateway VIP.
# Expected to be rejected by _addr_uniqueness_check.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.252"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/missing-dns-token.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: dns.provider "cloudflare" (the default) without a token.
# Expected to be rejected by the Dns validator.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[domain]
name = "example.com"
[dns]
provider = "cloudflare"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/missing-external-gateway.toml
-28
View File
@@ -1,28 +0,0 @@
# Negative fixture: cloudflare-tunnel ingress without gateways.external.
# Expected to be rejected by the Config cross-check.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
[domain]
name = "example.com"
[dns]
token = "fake"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/missing-known-hosts.toml
-30
View File
@@ -1,30 +0,0 @@
# Negative fixture: ssh:// URL to a host without bundled SSH host keys
# (github.com/gitlab.com/codeberg.org) and no repository.known_hosts set.
# Expected to be rejected by the conditional known_hosts constraint.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "ssh://git@git.example.com/k8s/home-ops.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/missing-schematic.toml
-28
View File
@@ -1,28 +0,0 @@
# Negative fixture: a node without schematic_id and no [talos] default.
# Expected to be rejected by the schematic resolution in Config.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[domain]
name = "example.com"
[dns]
token = "fake"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
.github/template-tests/invalid/nested-cidr-overlap.toml
-30
View File
@@ -1,30 +0,0 @@
# Negative fixture: node_cidr is nested inside the default pod_cidr
# (10.42.0.0/16) without being string-equal to it.
# Expected to be rejected by _cidr_overlap_check.
[network]
node_cidr = "10.42.128.0/17"
[kubernetes.api]
addr = "10.42.128.254"
[gateways]
internal = "10.42.128.252"
dns = "10.42.128.253"
external = "10.42.128.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.42.128.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/node-addr-outside-cidr.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: node address is not inside network.node_cidr.
# Expected to be rejected by _node_addrs_in_node_cidr.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "192.168.1.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/node-uses-gateway-addr.toml
-30
View File
@@ -1,30 +0,0 @@
# Negative fixture: a node claims the default gateway address (defaults to
# the first IP in node_cidr).
# Expected to be rejected by _addr_uniqueness_check.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.1"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/non-canonical-cidr.toml
-30
View File
@@ -1,30 +0,0 @@
# Negative fixture: node_cidr written with host bits set instead of the
# network address.
# Expected to be rejected by _cidr_canonical_check.
[network]
node_cidr = "10.10.10.5/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/overlapping-cidrs.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: network.node_cidr overlaps the default kubernetes.pod_cidr (10.42.0.0/16).
# Expected to be rejected by `_cidrs_check` (list.UniqueItems).
[network]
node_cidr = "10.42.0.0/16"
[kubernetes.api]
addr = "10.42.0.254"
[gateways]
internal = "10.42.0.252"
dns = "10.42.0.253"
external = "10.42.0.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.42.0.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/partial-bgp.toml
-34
View File
@@ -1,34 +0,0 @@
# Negative fixture: two of the three BGP fields set; previously this
# silently left BGP disabled.
# Expected to be rejected by the Bgp all-or-nothing check.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[domain]
name = "example.com"
[dns]
token = "fake"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[cilium.bgp]
router_addr = "10.10.1.1"
router_asn = "64513"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/reserved-node-name.toml
-29
View File
@@ -1,29 +0,0 @@
# Negative fixture: a node name uses the reserved word "controller".
# Expected to be rejected by the #Node.name regex constraint.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "controller"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/tiny-svc-cidr.toml
-33
View File
@@ -1,33 +0,0 @@
# Negative fixture: svc_cidr too small to contain the derived CoreDNS
# address (10th IP).
# Expected to be rejected by _coredns_addr_in_svc_cidr.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes]
svc_cidr = "10.43.0.0/29"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/invalid/tunnel-without-dns.toml
-32
View File
@@ -1,32 +0,0 @@
# Negative fixture: cloudflare-tunnel ingress with dns.provider "none".
# Expected to be rejected by the Config cross-check.
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[domain]
name = "example.com"
[dns]
provider = "none"
[ingress]
mode = "cloudflare-tunnel"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/valid/direct.toml
-38
View File
@@ -1,38 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[domain]
name = "example.com"
[dns]
token = "fake"
[ingress]
mode = "direct"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/valid/internal.toml
-34
View File
@@ -1,34 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
[domain]
name = "example.com"
[dns]
provider = "none"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/valid/multi-controller.toml
-42
View File
@@ -1,42 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
[repository]
url = "ssh://git@github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
provider = "none"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-2"
address = "10.10.10.102"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:02"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/valid/no-webhook.toml
-36
View File
@@ -1,36 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
webhook_provider = "none"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/valid/private.toml
-39
View File
@@ -1,39 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "ssh://git@github.com/onedr0p/cluster-template.git"
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
mtu = 1500
secureboot = true
encrypt_disk = true
kernel_modules = ["nvidia", "nvidia_uvm"]
.github/template-tests/valid/public.toml
-59
View File
@@ -1,59 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
default_gateway = "10.10.10.1"
vlan_tag = "100"
dns_servers = ["1.1.1.1"]
ntp_servers = ["162.159.200.123"]
[kubernetes]
pod_cidr = "10.42.0.0/16"
svc_cidr = "10.43.0.0/16"
[kubernetes.api]
addr = "10.10.10.254"
tls_sans = ["example.com"]
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
branch = "main"
[domain]
name = "example.com"
[dns]
token = "fake"
[cilium]
loadbalancer_mode = "dsr"
[cilium.bgp]
router_addr = "10.10.1.1"
router_asn = "64513"
node_asn = "64514"
[talos]
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
mtu = 1500
secureboot = true
encrypt_disk = true
kernel_modules = ["nvidia", "nvidia_uvm"]
.github/template-tests/valid/selfhosted.toml
-39
View File
@@ -1,39 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
external = "10.10.10.251"
[repository]
url = "ssh://git@git.example.com/k8s/home-ops.git"
webhook_provider = "generic-hmac"
known_hosts = """
git.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
"""
[domain]
name = "example.com"
[dns]
token = "fake"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
[[nodes]]
name = "k8s-1"
address = "10.10.10.101"
controller = false
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:01"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/template-tests/valid/single-node.toml
-26
View File
@@ -1,26 +0,0 @@
[network]
node_cidr = "10.10.10.0/24"
[kubernetes.api]
addr = "10.10.10.254"
[gateways]
internal = "10.10.10.252"
dns = "10.10.10.253"
[domain]
name = "example.com"
[dns]
provider = "none"
[repository]
url = "https://github.com/onedr0p/cluster-template.git"
[[nodes]]
name = "k8s-0"
address = "10.10.10.100"
controller = true
disk = "/dev/sdfake"
mac_addr = "00:00:00:00:00:00"
schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
.github/workflows/template-e2e-cluster.yaml
-103
View File
@@ -1,103 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "E2E Cluster"
on:
workflow_dispatch:
pull_request:
branches: ["main"]
schedule:
- cron: "30 5 * * *"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions: {}
jobs:
bootstrap:
if: ${{ github.repository == 'onedr0p/cluster-template' }}
name: bootstrap (qemu)
runs-on: ubuntu-latest
permissions:
contents: read
services:
git:
image: ghcr.io/charmbracelet/soft-serve:v0.12.2
env:
SOFT_SERVE_GIT_ENABLED: "false"
SOFT_SERVE_LFS_ENABLED: "false"
SOFT_SERVE_SSH_LISTEN_ADDR: "127.0.0.1:23231"
SOFT_SERVE_STATS_ENABLED: "false"
ports:
- 8418:23232
entrypoint: /bin/sh
command: >-
-c "set -eu; ssh-keygen -q -t ed25519 -N '' -f /tmp/admin;
export SOFT_SERVE_INITIAL_ADMIN_KEYS=$(cat /tmp/admin.pub);
/usr/local/bin/soft serve & pid=$!;
until ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost settings anon-access read-write; do sleep 1; done;
ssh -q -i /tmp/admin -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -p 23231 localhost repo create repo;
wait $pid"
options: >-
--health-cmd "git ls-remote http://localhost:23232/repo.git"
--health-interval 2s
--health-timeout 2s
--health-retries 30
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install QEMU
run: |
sudo apt-get update
sudo apt-get install --yes --no-install-recommends gettext-base qemu-system-x86 qemu-utils ovmf
- name: Setup mise
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
- name: Boot maintenance-mode nodes
id: cluster
uses: home-operations/talosctl-cluster-action@fb6a31bf5de43218acc80d2e23958a16eee7380c # v0.2.2
with:
config: ./.github/template-tests/e2e/talos-cluster.yaml
cache: true
- name: Export cluster environment
env:
CONTROLPLANE_IPS: "${{ steps.cluster.outputs.controlplane-ips }}"
GATEWAY: "${{ steps.cluster.outputs.gateway }}"
WORKER_IPS: "${{ steps.cluster.outputs.worker-ips }}"
run: |
echo "E2E_CONTROLPLANE_IPS=$CONTROLPLANE_IPS" >> "$GITHUB_ENV"
echo "E2E_WORKER_IPS=$WORKER_IPS" >> "$GITHUB_ENV"
echo "E2E_GATEWAY=$GATEWAY" >> "$GITHUB_ENV"
echo "E2E_CIDR=10.9.0.0/24" >> "$GITHUB_ENV"
echo "E2E_STATE=$RUNNER_TEMP/template-e2e" >> "$GITHUB_ENV"
- name: Prepare cluster
run: bash ./.github/template-tests/e2e/cluster.sh prepare
- name: Build healthy cluster foundation
run: bash ./.github/template-tests/e2e/cluster.sh foundation
- name: Test Flux SOPS
id: flux-sops
run: bash ./.github/template-tests/e2e/cluster.sh flux-sops
background: true
- name: Test networking
id: networking
run: bash ./.github/template-tests/e2e/cluster.sh networking
background: true
- name: Wait for E2E tests
wait: [flux-sops, networking]
- name: Summarize cluster
run: bash ./.github/template-tests/e2e/cluster.sh summary
.github/workflows/template-e2e.yaml
-176
View File
@@ -1,176 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "E2E"
on:
workflow_dispatch:
push:
branches:
- main
pull_request:
branches:
- main
concurrency:
group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
cancel-in-progress: true
permissions: {}
jobs:
validate-invalid:
if: ${{ github.repository == 'onedr0p/cluster-template' }}
name: reject-invalid (${{ matrix.fixture }})
runs-on: ubuntu-latest
permissions:
contents: read
strategy:
fail-fast: false
matrix:
fixture:
- overlapping-cidrs
- nested-cidr-overlap
- non-canonical-cidr
- tiny-svc-cidr
- duplicate-gateway-addrs
- duplicate-node-names
- reserved-node-name
- bad-mac-address
- bad-repo-url
- missing-known-hosts
- node-addr-outside-cidr
- node-uses-gateway-addr
- gateway-node-collision
- bad-vlan-tag
- bad-bgp-asn
- missing-dns-token
- tunnel-without-dns
- missing-external-gateway
- missing-schematic
- partial-bgp
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup mise
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
- name: Assert schema rejects ${{ matrix.fixture }}.toml
run: |
fixture=./.github/template-tests/invalid/${{ matrix.fixture }}.toml
if uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" >/dev/null 2>&1; then
echo "::error::schema accepted invalid fixture ${{ matrix.fixture }} (expected rejection)"
exit 1
fi
echo "schema correctly rejected ${{ matrix.fixture }}"
# Also surface the actual error message in the log for debuggability.
uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" || true
validator-tests:
if: ${{ github.repository == 'onedr0p/cluster-template' }}
name: validator-tests
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup mise
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
- name: Run validator tests
run: uv run --quiet --locked pytest ./template/scripts/test_validate.py
validate-valid:
if: ${{ github.repository == 'onedr0p/cluster-template' }}
name: accept-valid (${{ matrix.fixture }})
runs-on: ubuntu-latest
permissions:
contents: read
strategy:
fail-fast: false
matrix:
fixture:
- public
- private
- selfhosted
- no-webhook
- internal
- direct
- single-node
- multi-controller
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup mise
uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
with:
experimental: true
install_args: --locked
- name: Run init recipe
run: just init
- name: Prepare files
run: |
cp ./.github/template-tests/valid/${{ matrix.fixture }}.toml cluster.toml
echo '{"AccountTag":"fake","TunnelSecret":"fake","TunnelID":"fake"}' > cloudflare-tunnel.json
touch kubeconfig
- name: Assert cluster.toml passes the JSON Schema
run: taplo check --schema "file://$PWD/cluster.schema.json" ./cluster.toml
- name: Run configure recipe
run: just configure
# Rendered output must already match the format-yaml pre-commit hook,
# otherwise every `just configure` shows up as formatting churn.
- name: Assert rendered output is formatted
run: oxfmt --check ./.sops.yaml ./bootstrap ./kubernetes ./talos
- name: Install flate
uses: home-operations/flate/action@631b76b69c4e58c6f4d1cb01e23616fa61aebafa # v0.6.5
with:
base: ""
- name: Run flate test
run: flate test all -p ./kubernetes/flux/cluster
- name: Render bootstrap helmfile charts
run: just template test-helmfile
- name: Dry run bootstrap talos recipe
run: just --dry-run bootstrap talos
- name: Create talos secret
run: just bootstrap talos-secret
- name: Render talos configs
run: just talos render
- name: Validate talos configs
run: |
for config in ./talos/rendered/*.yaml; do
talosctl validate --config "$config" --mode metal
done
- name: Dry run bootstrap apps recipe
run: just --dry-run bootstrap apps
- name: Run reset recipe
run: yes | just template reset
- name: Run tidy recipe
run: yes | just template tidy
.github/workflows/template-release.yaml
-58
View File
@@ -1,58 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Release"
on:
workflow_dispatch:
schedule:
- cron: 0 0 1 * *
permissions: {}
jobs:
release:
name: Release
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Get Previous Release Tag and Determine Next Tag
id: determine-next-tag
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
result-encoding: string
script: |
const { data: releases } = await github.rest.repos.listReleases({
owner: context.repo.owner,
repo: context.repo.repo,
per_page: 1,
});
let previousTag = "0.0.0"; // Default if no previous release exists
if (releases.length > 0) {
previousTag = releases[0].tag_name;
}
const [previousMajor, previousMinor, previousPatch] = previousTag.split('.').map(Number);
const currentYear = new Date().getFullYear();
const currentMonth = new Date().getMonth() + 1; // Months are 0-indexed in JavaScript
const nextMajorMinor = `${currentYear}.${currentMonth}`;
let nextPatch;
if (`${previousMajor}.${previousMinor}` === nextMajorMinor) {
console.log("Month release already exists for the year. Incrementing patch number by 1.");
nextPatch = previousPatch + 1;
} else {
console.log("Month release does not exist for the year. Starting with patch number 0.");
nextPatch = 0;
}
return `${nextMajorMinor}.${nextPatch}`;
- name: Create Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TAG: ${{ steps.determine-next-tag.outputs.result }}
run: gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --generate-notes
.mise/conf.d/template.toml
-5
View File
@@ -1,5 +0,0 @@
# Tools only the template step needs; `just template tidy` archives this file.
[tools]
uv = "0.12.13"
sd = "1.1.0"
taplo = "0.10.0"
.mise/mise.lock
-73
View File
@@ -384,30 +384,6 @@ url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-x64.tar.gz"
version = "0.67.0" version = "0.67.0"
backend = "npm:oxfmt" backend = "npm:oxfmt"
[[tools.sd]]
version = "1.1.0"
backend = "aqua:chmln/sd"
[tools.sd."platforms.linux-arm64"]
checksum = "sha256:ec8c93c0533ff21f4851d11566808d4082544baf063d9b96ea77c27e98b7cd99"
url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-aarch64-unknown-linux-musl.tar.gz"
url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325535"
[tools.sd."platforms.linux-x64"]
checksum = "sha256:3613eca74cd686739bb5a6d68319aa56c747e7315274d02323a2ca2b1c5d82d2"
url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-x86_64-unknown-linux-gnu.tar.gz"
url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325296"
[tools.sd."platforms.macos-arm64"]
checksum = "sha256:4bd3c09226376ca0a1d69589c91e86276fae36c5fbaaee669afce583f6682030"
url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-aarch64-apple-darwin.tar.gz"
url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325451"
[tools.sd."platforms.macos-x64"]
checksum = "sha256:1fca1e9c91813a8aac6821063c923107ba0f66a83309e095edcd3b202f67f97e"
url = "https://github.com/chmln/sd/releases/download/v1.1.0/sd-v1.1.0-x86_64-apple-darwin.tar.gz"
url_api = "https://api.github.com/repos/chmln/sd/releases/assets/362325430"
[[tools.sops]] [[tools.sops]]
version = "3.13.3" version = "3.13.3"
backend = "aqua:getsops/sops" backend = "aqua:getsops/sops"
@@ -472,55 +448,6 @@ url = "https://github.com/siderolabs/talos/releases/download/v1.14.0/talosctl-da
url_api = "https://api.github.com/repos/siderolabs/talos/releases/assets/542359004" url_api = "https://api.github.com/repos/siderolabs/talos/releases/assets/542359004"
provenance = "cosign" provenance = "cosign"
[[tools.taplo]]
version = "0.10.0"
backend = "aqua:tamasfe/taplo"
[tools.taplo."platforms.linux-arm64"]
url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aarch64.gz"
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597"
[tools.taplo."platforms.linux-x64"]
checksum = "blake3:4871fab0e60275a1eb46e7190726e144f56c9a9527f59b0d1da5a042baead8e2"
url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"
[tools.taplo."platforms.macos-arm64"]
url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-aarch64.gz"
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323110"
[tools.taplo."platforms.macos-x64"]
url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-darwin-x86_64.gz"
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323116"
[[tools.uv]]
version = "0.12.13"
backend = "aqua:astral-sh/uv"
[tools.uv."platforms.linux-arm64"]
checksum = "sha256:2eaa5d94f5db7b3a1a092156b9420459e42ab0217d917fe74a876309cef9b5e9"
url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz"
url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670186"
provenance = "github-attestations"
[tools.uv."platforms.linux-x64"]
checksum = "sha256:745765a3b6e360ad76743599ae5c42e9278c7edf8bbff9fc76d05bf2623a04dd"
url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-x86_64-unknown-linux-gnu.tar.gz"
url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670375"
provenance = "github-attestations"
[tools.uv."platforms.macos-arm64"]
checksum = "sha256:7e6ddb9316acc00f2296c82ff4d99977870ee34b2f0ddcae9444d714db9364ed"
url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz"
url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670160"
provenance = "github-attestations"
[tools.uv."platforms.macos-x64"]
checksum = "sha256:5e287ef61cb6a9b61b3a83fef124fd143e400468a7dac794230147a810e17119"
url = "https://github.com/astral-sh/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz"
url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/555670348"
provenance = "github-attestations"
[[tools.yq]] [[tools.yq]]
version = "4.53.6" version = "4.53.6"
backend = "aqua:mikefarah/yq" backend = "aqua:mikefarah/yq"
cluster.sample.toml
-292
View File
@@ -1,292 +0,0 @@
#:schema ./cluster.schema.json
# =============================================================================
# Physical LAN that your Talos nodes live on. Defines the address space
# used for node IPs, the gateway/DNS/NTP servers nodes will use, and an
# optional VLAN tag for switch ports that aren't natively tagged.
# =============================================================================
[network]
# The CIDR block your nodes' IPs come from. Every node's `address`, the Kube
# API VIP, and the gateway VIPs (internal/dns/external) must all sit inside
# this range.
# REQUIRED. Example: "192.168.1.0/24"
node_cidr = ""
# Upstream DNS servers Talos nodes use for name resolution. Defaults to
# Cloudflare (1.1.1.1 / 1.0.0.1). Override if you run an internal resolver
# (Pi-hole, Unbound, AdGuard) or want a different public provider.
# OPTIONAL. Default: ["1.1.1.1", "1.0.0.1"]
# dns_servers = ["1.1.1.1", "1.0.0.1"]
# Upstream NTP servers. Defaults to Cloudflare's anycast NTP. Most homelabs
# don't need to change this.
# OPTIONAL. Default: ["162.159.200.1", "162.159.200.123"]
# ntp_servers = ["162.159.200.1", "162.159.200.123"]
# Default gateway IP that nodes use to reach the rest of your LAN/WAN.
# Defaults to the first usable host in node_cidr (e.g. 192.168.1.1 for
# 192.168.1.0/24), which is correct for most home routers. Override if your
# router lives at a non-standard address inside the subnet.
# OPTIONAL. Default: first IP in node_cidr
# default_gateway = ""
# 802.1Q VLAN tag to apply to the Talos node interface. Only set this if
# your switch ports are configured as trunks (passing tagged traffic to the
# nodes); access ports already untag VLAN traffic. Must be 1-4094.
# REF: https://www.talos.dev/latest/advanced/advanced-networking/#vlans
# OPTIONAL.
# vlan_tag = ""
# =============================================================================
# Cluster-internal control plane and overlay networks. The pod and service
# CIDRs are in-cluster only — they don't have to be routable on your LAN
# and never appear on the wire outside the nodes.
# =============================================================================
[kubernetes]
# CIDR Cilium hands out to pods. /16 gives ~64K pod IPs, which is well beyond
# what a homelab needs but matches the upstream default. Must NOT overlap
# with node_cidr or svc_cidr.
# OPTIONAL. Default: "10.42.0.0/16"
# pod_cidr = "10.42.0.0/16"
# CIDR for ClusterIP services (the virtual IPs `kubectl get svc` shows).
# Same /16 reasoning as pod_cidr. Must NOT overlap with node_cidr or
# pod_cidr.
# OPTIONAL. Default: "10.43.0.0/16"
# svc_cidr = "10.43.0.0/16"
# ClusterIP for the CoreDNS Service. Must be inside svc_cidr.
# OPTIONAL. Default: the 10th IP in svc_cidr
# coredns_addr = ""
[kubernetes.api]
# Virtual IP for the Kubernetes API server. kubectl, flux, and every other
# client connect here on port 6443. Must be an unused IP inside
# network.node_cidr — kube-vip floats it across controller nodes.
# REQUIRED.
addr = ""
# Additional Subject Alternative Names to put on the Kube API cert. Useful
# if you want to call the API by hostname (e.g. via a CNAME or local
# /etc/hosts entry) instead of the raw IP.
# OPTIONAL. Example: ["mycluster.example.com"]
# tls_sans = ["mycluster.example.com"]
# =============================================================================
# LoadBalancer IPs that Cilium hands out to the cluster's edge gateways.
# Each must be an unused address inside network.node_cidr, and all four
# (these three plus kubernetes.api.addr) must be distinct.
# =============================================================================
[gateways]
# IP for the `envoy-internal` gateway — used by HTTPRoutes intended for
# private/in-network access only. Most apps use this gateway by default.
# REQUIRED.
internal = ""
# IP for `k8s_gateway`, which serves DNS for cluster-managed hostnames.
# Point your home DNS server's conditional forwarder for domain.name
# at this IP to enable split-DNS resolution from your LAN.
# REQUIRED.
dns = ""
# IP for the `envoy-external` gateway — sits behind the ingress path (e.g.
# the cloudflared tunnel) and handles traffic exposed to the public
# internet. HTTPRoutes that reference this gateway become reachable via
# your public domain.
# REQUIRED unless ingress.mode is "none" (internal-only cluster).
external = ""
# =============================================================================
# The Git repo Flux will sync from. This is the single source of truth
# for everything in your cluster — once bootstrapped, changes are made by
# pushing to this repo. Any Git host works: GitHub, GitLab, Gitea,
# Forgejo, Codeberg or self-hosted.
# =============================================================================
[repository]
# Full clone URL of the repository this cluster will pull from.
# Must be the repo you cloned this template into.
# Use `https://` if the repo is publicly readable (or `http://` for a
# LAN-local git server). Use `ssh://git@` if it is
# private: the template then wires up a deploy key (`deploy.key.pub`) so
# Flux can clone over SSH; see the README for the extra setup step.
# REQUIRED. Examples:
# "https://github.com/onedr0p/home-ops.git"
# "ssh://git@gitlab.com/onedr0p/home-ops.git"
# "ssh://git@git.example.com/k8s/home-ops.git"
url = ""
# Branch Flux watches. Changes pushed to this branch get reconciled into the
# cluster.
# OPTIONAL. Default: "main"
# branch = "main"
# Webhook payload format the Flux webhook Receiver verifies, so pushes are
# reconciled instantly. Gitea and Forgejo emulate GitHub webhooks, so keep
# "github" for them. Use "generic-hmac" for anything else that signs with
# HMAC; see https://fluxcd.io/flux/components/notification/receivers/
# Use "none" to skip the webhook entirely (e.g. your Git host cannot reach
# the cluster); Flux then only polls on an interval.
# OPTIONAL. Default: "github".
# Allowed: "github" | "gitlab" | "generic-hmac" | "none"
# webhook_provider = "github"
# SSH host keys for your Git host (`ssh-keyscan -t ed25519,ecdsa,rsa <host>`
# output). Only used with `ssh://` URLs. Keys for github.com, gitlab.com and
# codeberg.org are bundled; REQUIRED for any other host.
# OPTIONAL. Example:
# known_hosts = """
# git.example.com ssh-ed25519 AAAA...
# """
# known_hosts = ""
# =============================================================================
# The domain your cluster's hostnames live under. Used for every rendered
# hostname (echo, flux-webhook, internal split DNS) and the wildcard
# certificate, regardless of DNS provider.
# =============================================================================
[domain]
# REQUIRED. Example: "example.com"
name = ""
# =============================================================================
# Public DNS authority and certificate issuance. With "cloudflare",
# external-dns publishes records automatically and cert-manager issues a
# Let's Encrypt wildcard via ACME DNS-01. With "none", nothing is
# published and the wildcard certificate is issued by an in-cluster
# self-signed CA instead (internal-only cluster).
# =============================================================================
[dns]
# OPTIONAL. Default: "cloudflare". Allowed: "cloudflare" | "none"
# provider = "cloudflare"
# Cloudflare API token (NOT the global API key) with `Zone - DNS - Edit` and
# `Account - Cloudflare Tunnel - Read` permissions, scoped to the zone
# above. See the README for token creation steps.
# REQUIRED when provider is "cloudflare"; must be empty otherwise.
token = ""
# =============================================================================
# How the public internet reaches the cluster's external gateway. With
# "cloudflare-tunnel", cloudflared connects outbound so no ports are
# forwarded (requires dns.provider = "cloudflare" and
# cloudflare-tunnel.json). With "direct", you forward TCP 443 (and
# optionally 80) on your router to gateways.external and point an
# `external.<domain>` DNS record at your WAN address (A record or DDNS
# CNAME) yourself; per-app records are still published automatically.
# With "none", nothing is exposed and apps are only reachable on your
# LAN via the internal gateway.
# =============================================================================
[ingress]
# OPTIONAL. Default: "cloudflare-tunnel" when dns.provider is "cloudflare",
# otherwise "none". Allowed: "cloudflare-tunnel" | "direct" | "none"
# mode = "cloudflare-tunnel"
# =============================================================================
# CNI configuration. Defaults are sane for most homelab setups; touch
# this section only if you need BGP peering or a different LB mode.
# =============================================================================
[cilium]
# How Cilium's load balancer handles return traffic. `dsr` (Direct Server
# Return) preserves the client IP and is faster, but requires a switch
# fabric that won't drop asymmetric flows. `snat` masquerades the client
# and is the safe default for unknown topologies.
# REF: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
# OPTIONAL. Default: "dsr". Allowed: "dsr" | "snat"
# loadbalancer_mode = "dsr"
# Cilium BGP peering — advertises Service IPs to your upstream router so
# LoadBalancer addresses become reachable from anywhere on your LAN
# (rather than only via L2 ARP). Set ALL THREE fields below to enable;
# leaving any blank disables BGP entirely.
# REF: https://docs.cilium.io/en/latest/network/bgp-control-plane/bgp-control-plane/
[cilium.bgp]
# IP of your BGP-speaking router. The cluster peers with it from each node.
# OPTIONAL. Example: "192.168.1.1"
# router_addr = ""
# ASN your router uses for BGP. Anything in the private range (64512-65534)
# is fine if you're not peering with the public internet.
# OPTIONAL. Example: "64513"
# router_asn = ""
# ASN the cluster's nodes use for BGP. Pick a different value than
# router_asn so peering is eBGP rather than iBGP.
# OPTIONAL. Example: "64514"
# node_asn = ""
# =============================================================================
# Talos Image Factory settings shared by all nodes.
# =============================================================================
[talos]
# Default schematic for every node that doesn't set its own schematic_id.
# The 64-character hex string from your build at https://factory.talos.dev/
# OPTIONAL if every node sets schematic_id itself.
schematic_id = ""
# =============================================================================
# One [[nodes]] table per physical machine or VM in the cluster. At least
# one controller (controller=true) is required; worker nodes are optional.
# For HA, use 3 controllers.
#
# Discover hardware details from a node already booted into Talos
# maintenance mode:
# talosctl get disks -n <node-ip> --insecure
# talosctl get links -n <node-ip> --insecure
# Schematic ID is the 64-character hex string from your build at:
# https://factory.talos.dev/
#
# The block below is a template — copy it once per node, uncomment, and
# fill in the values.
# =============================================================================
# [[nodes]]
# name = "k8s-0" # Hostname; must match [a-z0-9-]+ (not "global"/"controller"/"worker").
# address = "192.168.1.10" # Static IP; must be inside network.node_cidr.
# controller = true # true = control-plane (etcd + API server), false = worker.
# disk = "/dev/nvme0n1" # Block device or /dev/disk/by-id/... symlink to install Talos onto.
# mac_addr = "aa:bb:cc:dd:ee:ff" # Primary NIC MAC.
#
# # Optional when [talos] sets a cluster-wide default:
# schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba" # 64-hex from factory.talos.dev.
#
# # Optional advanced fields (each independently uncommentable):
# mtu = 1500 # Set only for jumbo frames / non-1500 MTUs (1450-9000).
# secureboot = false # UEFI SecureBoot — requires a SecureBoot-enabled schematic.
# encrypt_disk = false # TPM-bound full-disk encryption.
# kernel_modules = ["nvidia", "nvidia_uvm"] # Only for schematics shipping matching extensions.
cluster.schema.json
-433
View File
@@ -1,433 +0,0 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$defs": {
"Api": {
"additionalProperties": false,
"properties": {
"addr": {
"format": "ipv4",
"title": "Addr",
"type": "string"
},
"tls_sans": {
"anyOf": [
{
"items": {
"$ref": "#/$defs/Fqdn"
},
"type": "array"
},
{
"type": "null"
}
],
"default": null,
"title": "Tls Sans"
}
},
"required": ["addr"],
"title": "Api",
"type": "object"
},
"Asn": {
"type": "string"
},
"Bgp": {
"additionalProperties": false,
"properties": {
"router_addr": {
"anyOf": [
{
"format": "ipv4",
"type": "string"
},
{
"const": "",
"type": "string"
}
],
"default": "",
"title": "Router Addr"
},
"router_asn": {
"$ref": "#/$defs/Asn",
"default": ""
},
"node_asn": {
"$ref": "#/$defs/Asn",
"default": ""
}
},
"title": "Bgp",
"type": "object"
},
"Cidr": {
"format": "ipv4network",
"type": "string"
},
"Cilium": {
"additionalProperties": false,
"properties": {
"loadbalancer_mode": {
"default": "dsr",
"enum": ["dsr", "snat"],
"title": "Loadbalancer Mode",
"type": "string"
},
"bgp": {
"$ref": "#/$defs/Bgp",
"default": {
"router_addr": "",
"router_asn": "",
"node_asn": ""
}
}
},
"title": "Cilium",
"type": "object"
},
"Dns": {
"additionalProperties": false,
"properties": {
"provider": {
"default": "cloudflare",
"enum": ["cloudflare", "none"],
"title": "Provider",
"type": "string"
},
"token": {
"default": "",
"title": "Token",
"type": "string"
}
},
"title": "Dns",
"type": "object"
},
"Domain": {
"additionalProperties": false,
"properties": {
"name": {
"$ref": "#/$defs/Fqdn"
}
},
"required": ["name"],
"title": "Domain",
"type": "object"
},
"Fqdn": {
"pattern": "^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$",
"type": "string"
},
"Gateways": {
"additionalProperties": false,
"properties": {
"internal": {
"format": "ipv4",
"title": "Internal",
"type": "string"
},
"dns": {
"format": "ipv4",
"title": "Dns",
"type": "string"
},
"external": {
"anyOf": [
{
"format": "ipv4",
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"title": "External"
}
},
"required": ["internal", "dns"],
"title": "Gateways",
"type": "object"
},
"Ingress": {
"additionalProperties": false,
"properties": {
"mode": {
"default": "cloudflare-tunnel",
"enum": ["cloudflare-tunnel", "direct", "none"],
"title": "Mode",
"type": "string"
}
},
"title": "Ingress",
"type": "object"
},
"Kubernetes": {
"additionalProperties": false,
"properties": {
"pod_cidr": {
"$ref": "#/$defs/Cidr",
"default": "10.42.0.0/16"
},
"svc_cidr": {
"$ref": "#/$defs/Cidr",
"default": "10.43.0.0/16"
},
"coredns_addr": {
"format": "ipv4",
"title": "Coredns Addr",
"type": "string"
},
"api": {
"$ref": "#/$defs/Api"
}
},
"required": ["api"],
"title": "Kubernetes",
"type": "object"
},
"Network": {
"additionalProperties": false,
"properties": {
"node_cidr": {
"$ref": "#/$defs/Cidr"
},
"dns_servers": {
"default": ["1.1.1.1", "1.0.0.1"],
"items": {
"format": "ipv4",
"type": "string"
},
"title": "Dns Servers",
"type": "array"
},
"ntp_servers": {
"default": ["162.159.200.1", "162.159.200.123"],
"items": {
"format": "ipv4",
"type": "string"
},
"title": "Ntp Servers",
"type": "array"
},
"default_gateway": {
"format": "ipv4",
"title": "Default Gateway",
"type": "string"
},
"vlan_tag": {
"anyOf": [
{
"pattern": "^[0-9]+$",
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"title": "Vlan Tag"
}
},
"required": ["node_cidr"],
"title": "Network",
"type": "object"
},
"Node": {
"additionalProperties": false,
"properties": {
"name": {
"pattern": "^[a-z0-9][a-z0-9\\-]{0,61}[a-z0-9]$|^[a-z0-9]$",
"title": "Name",
"type": "string"
},
"address": {
"format": "ipv4",
"title": "Address",
"type": "string"
},
"controller": {
"title": "Controller",
"type": "boolean"
},
"disk": {
"title": "Disk",
"type": "string"
},
"mac_addr": {
"pattern": "^([0-9a-f]{2}:){5}[0-9a-f]{2}$",
"title": "Mac Addr",
"type": "string"
},
"schematic_id": {
"anyOf": [
{
"pattern": "^[a-z0-9]{64}$",
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"title": "Schematic Id"
},
"mtu": {
"default": 1500,
"maximum": 9000,
"minimum": 1450,
"title": "Mtu",
"type": "integer"
},
"secureboot": {
"default": false,
"title": "Secureboot",
"type": "boolean"
},
"encrypt_disk": {
"default": false,
"title": "Encrypt Disk",
"type": "boolean"
},
"kernel_modules": {
"default": [],
"items": {
"type": "string"
},
"title": "Kernel Modules",
"type": "array"
}
},
"required": ["name", "address", "controller", "disk", "mac_addr"],
"title": "Node",
"type": "object"
},
"Repository": {
"additionalProperties": false,
"properties": {
"url": {
"pattern": "^(https?://|ssh://git@)[^/]+/.+$",
"title": "Url",
"type": "string"
},
"branch": {
"default": "main",
"minLength": 1,
"title": "Branch",
"type": "string"
},
"webhook_provider": {
"default": "github",
"enum": ["github", "gitlab", "generic-hmac", "none"],
"title": "Webhook Provider",
"type": "string"
},
"known_hosts": {
"default": "",
"title": "Known Hosts",
"type": "string"
}
},
"required": ["url"],
"title": "Repository",
"type": "object"
},
"Spegel": {
"additionalProperties": false,
"properties": {
"enabled": {
"anyOf": [
{
"type": "boolean"
},
{
"type": "null"
}
],
"default": null,
"title": "Enabled"
}
},
"title": "Spegel",
"type": "object"
},
"Talos": {
"additionalProperties": false,
"properties": {
"schematic_id": {
"anyOf": [
{
"pattern": "^[a-z0-9]{64}$",
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"title": "Schematic Id"
}
},
"title": "Talos",
"type": "object"
}
},
"additionalProperties": false,
"properties": {
"network": {
"$ref": "#/$defs/Network"
},
"kubernetes": {
"$ref": "#/$defs/Kubernetes"
},
"gateways": {
"$ref": "#/$defs/Gateways"
},
"repository": {
"$ref": "#/$defs/Repository"
},
"domain": {
"$ref": "#/$defs/Domain"
},
"dns": {
"$ref": "#/$defs/Dns"
},
"ingress": {
"$ref": "#/$defs/Ingress"
},
"cilium": {
"$ref": "#/$defs/Cilium",
"default": {
"loadbalancer_mode": "dsr",
"bgp": {
"node_asn": "",
"router_addr": "",
"router_asn": ""
}
}
},
"talos": {
"$ref": "#/$defs/Talos",
"default": {
"schematic_id": null
}
},
"spegel": {
"$ref": "#/$defs/Spegel",
"default": {
"enabled": null
}
},
"nodes": {
"items": {
"$ref": "#/$defs/Node"
},
"title": "Nodes",
"type": "array"
}
},
"required": ["network", "kubernetes", "gateways", "repository", "domain", "dns", "nodes"],
"title": "cluster.toml",
"type": "object"
}
justfile
-15
View File
@@ -17,18 +17,3 @@ mod? talos 'talos'
[private] [private]
log lvl msg *args: log lvl msg *args:
gum log -t rfc3339 -s -l "{{ lvl }}" "{{ msg }}" {{ args }} gum log -t rfc3339 -s -l "{{ lvl }}" "{{ msg }}" {{ args }}
# === template ===
[group('template')]
mod template 'template'
[doc('Render and validate configuration files')]
[group('template')]
configure:
just template configure
[doc('Initialize configuration files (cluster.toml, age key, deploy key, webhook token)')]
[group('template')]
init:
just template init
makejinja.toml
-19
View File
@@ -1,19 +0,0 @@
[makejinja]
inputs = ["./template/overrides","./template/config"]
output = "./"
exclude_patterns = ["*.partial.yaml.j2"]
data = ["./cluster.toml"]
import_paths = ["./template/scripts"]
loaders = ["plugin:Plugin"]
jinja_suffix = ".j2"
copy_metadata = true
force = true
undefined = "strict"
[makejinja.delimiter]
block_start = "#%"
block_end = "%#"
comment_start = "#|"
comment_end = "#|"
variable_start = "#{"
variable_end = "}#"
pyproject.toml
-16
View File
@@ -1,16 +0,0 @@
[project]
name = "cluster-template"
version = "0.0.0"
requires-python = ">=3.14"
dependencies = [
"makejinja==2.8.3",
"pydantic==2.13.5",
]
[dependency-groups]
dev = [
"pytest>=8",
]
[tool.uv]
package = false
template/config/.sops.yaml.j2
-12
View File
@@ -1,12 +0,0 @@
---
creation_rules:
- path_regex: talos/.*\.sops\.ya?ml
mac_only_encrypted: true
age: "#{ age_key('public') }#"
- path_regex: (bootstrap|kubernetes)/.*\.sops\.ya?ml
encrypted_regex: "^(data|stringData)$"
mac_only_encrypted: true
age: "#{ age_key('public') }#"
stores:
yaml:
indent: 2
template/config/bootstrap/deploy-key.sops.yaml.j2
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Secret
metadata:
name: deploy-key
namespace: flux-system
stringData:
identity: |
#% filter indent(width=4, first=False) %#
#{ deploy_key() }#
#% endfilter %#
known_hosts: |
#% filter indent(width=4, first=False) %#
#{ repository.known_hosts }#
#% endfilter %#
template/config/bootstrap/helmfile/apps.yaml.j2
-60
View File
@@ -1,60 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
# Bootstraps core applications that provide a minimal runtime base for the
# cluster. These releases are installed first so the cluster has the resources
# Flux needs before its own reconciliation begins.
#
# After this bootstrap phase, Flux is ready to take over management of the
# application stack and continue reconciling downstream state.
helmDefaults:
cleanupOnFail: true
forceConflicts: true
wait: true
waitForJobs: true
bases:
- default.yaml
releases:
- name: cilium
namespace: kube-system
inherit:
- template: default
- name: coredns
namespace: kube-system
inherit:
- template: default
needs: ["kube-system/cilium"]
#% if spegel.enabled %#
- name: spegel
namespace: kube-system
inherit:
- template: default
needs: ["kube-system/coredns"]
#% endif %#
- name: cert-manager
namespace: cert-manager
inherit:
- template: default
#% if spegel.enabled %#
needs: ["kube-system/spegel"]
#% else %#
needs: ["kube-system/coredns"]
#% endif %#
- name: flux-operator
namespace: flux-system
inherit:
- template: default
needs: ["cert-manager/cert-manager"]
- name: flux-instance
namespace: flux-system
inherit:
- template: default
needs: ["flux-system/flux-operator"]
template/config/bootstrap/helmfile/crds.yaml.j2
-37
View File
@@ -1,37 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
# Bootstraps cluster-wide Custom Resource Definitions (CRDs) by extracting them
# from upstream Helm charts and applying them directly with kubectl. The releases
# below are never reconciled with helmfile apply or helmfile sync — only their
# CRDs are rendered (via --include-crds) and piped to the cluster.
#
# Installing CRDs out-of-band ensures they exist before Flux begins reconciling
# workloads that reference them, avoiding the need for dependsOn chains on nearly
# every Kustomization that consumes a CRD-backed resource.
helmDefaults:
args:
- --include-crds
- --no-hooks
bases:
- default.yaml
releases:
#% if dns.provider == 'cloudflare' and ingress.mode != 'none' %#
- name: cloudflare-dns
namespace: network
inherit:
- template: default
#% endif %#
- name: envoy-gateway
namespace: network
inherit:
- template: default
- name: prometheus-operator-crds
namespace: observability
chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
version: 29.0.0
template/config/bootstrap/helmfile/default.yaml.j2
-8
View File
@@ -1,8 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
templates:
default:
chart: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).chart }}'
version: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).version }}'
values:
- ./templates/values.yaml.gotmpl
template/config/bootstrap/helmfile/templates/release.yaml.gotmpl.j2
-3
View File
@@ -1,3 +0,0 @@
{{- $oci := fromYaml (readFile (printf "../../kubernetes/apps/%s/%s/app/ocirepository.yaml" .Release.Namespace .Release.Name)) -}}
chart: {{ $oci.spec.url }}
version: {{ $oci.spec.ref.tag }}
template/config/bootstrap/helmfile/templates/values.yaml.gotmpl.j2
-1
View File
@@ -1 +0,0 @@
{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values | toYaml }}
template/config/bootstrap/mod.just
-105
View File
@@ -1,105 +0,0 @@
set no-exit-message
set quiet
set shell := ['bash', '-euo', 'pipefail', '-c']
set script-interpreter := ['bash', '-euo', 'pipefail']
set default-list
set default-script
kubernetes_dir := justfile_dir() + '/kubernetes'
[doc('Bootstrap the Talos cluster')]
[group('bootstrap')]
talos: talos-secret talos-apply talos-talosconfig talos-kubeconfig
[doc('Bootstrap apps into the Talos cluster')]
[group('bootstrap')]
apps: apps-ready apps-namespaces apps-secrets apps-crds apps-helm
just log info "Cluster is bootstrapped — Flux will start syncing the Git repository"
# No sops call or existence guard is needed: the bundle is stored already
# encrypted with the repo's age recipient, and existing bundles are left
# untouched.
[private]
[working-directory('../talos')]
talos-secret:
just log info "Generating secrets" stage "{{ recipe_name() }}"
topf secrets --confirm=false > /dev/null
[private]
[working-directory('../talos')]
talos-apply:
just log info "Applying talos config and bootstrapping" stage "{{ recipe_name() }}"
topf apply --auto-bootstrap --confirm=false
[private]
[working-directory('../talos')]
talos-talosconfig:
just log info "Generating talosconfig" stage "{{ recipe_name() }}"
topf talosconfig > talosconfig
# topf issues short-lived admin certs by default; 8760h keeps the
# kubeconfig usable long-term.
[private]
[working-directory('../talos')]
talos-kubeconfig:
just log info "Fetching kubeconfig" stage "{{ recipe_name() }}"
topf kubeconfig --validity 8760h > "{{ justfile_dir() }}/kubeconfig"
[private]
apps-crds:
just log info "Applying CRDs" stage "{{ recipe_name() }}"
if ! helmfile --file "{{ source_directory() }}/helmfile/crds.yaml" template --quiet | yq eval-all --exit-status 'select(.kind == "CustomResourceDefinition")' | kubectl apply --server-side --force-conflicts --filename -; then
just log fatal "Failed to apply crds"
fi
[private]
apps-helm:
just log info "Syncing helmfile" stage "{{ recipe_name() }}"
if ! helmfile --file "{{ source_directory() }}/helmfile/apps.yaml" sync --hide-notes; then
just log fatal "Failed to sync helmfile"
fi
[private]
apps-namespaces:
just log info "Applying namespaces for apps" stage "{{ recipe_name() }}"
for app in "{{ kubernetes_dir }}/apps"/*/; do
ns="$(basename "$app")"
if kubectl create namespace "$ns" --dry-run=client -o yaml \
| kubectl apply --server-side --filename - &>/dev/null; then
just log info "Namespace applied" namespace "$ns"
else
just log fatal "Failed to apply namespace" namespace "$ns"
fi
done
[private]
apps-secrets:
just log info "Applying secrets for apps" stage "{{ recipe_name() }}"
for secret in \
"{{ source_directory() }}/deploy-key.sops.yaml" \
"{{ source_directory() }}/sops-age.sops.yaml" \
"{{ kubernetes_dir }}/components/sops/cluster-secrets.sops.yaml"
do
name="$(basename "$secret" .sops.yaml)"
if sops decrypt "$secret" \
| kubectl --namespace flux-system apply --server-side --filename - &>/dev/null; then
just log info "Secret applied" resource "$name"
else
just log fatal "Failed to apply secret" resource "$name"
fi
done
# Wait until nodes register as Ready=False. They only become Ready=True once the CNI is healthy.
[private]
apps-ready:
just log info "Waiting for nodes to register as Ready=False" stage "{{ recipe_name() }}"
if ! kubectl wait nodes --for=condition=Ready=True --all --timeout=10s &>/dev/null; then
deadline=$((SECONDS + 600))
until kubectl wait nodes --for=condition=Ready=False --all --timeout=10s &>/dev/null; do
if (( SECONDS >= deadline )); then
just log fatal "Timed out waiting for nodes to register"
fi
just log info "Nodes not available, waiting for nodes to be available. Retrying in 5 seconds..."
sleep 5
done
fi
template/config/bootstrap/sops-age.sops.yaml.j2
-8
View File
@@ -1,8 +0,0 @@
---
apiVersion: v1
kind: Secret
metadata:
name: sops-age
namespace: flux-system
stringData:
age.agekey: "#{ age_key('private') }#"
template/config/kubernetes/apps/cert-manager/cert-manager/app/clusterissuer.yaml.j2
-52
View File
@@ -1,52 +0,0 @@
#% if dns.provider == 'cloudflare' %#
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
privateKeySecretRef:
name: letsencrypt-production
profile: shortlived
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cert-manager-secret
key: api-token
selector:
dnsZones: ["${SECRET_DOMAIN}"]
#% else %#
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: internal-ca
spec:
isCA: true
commonName: internal-ca
secretName: internal-ca
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned
kind: ClusterIssuer
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: internal-ca
spec:
ca:
secretName: internal-ca
#% endif %#
template/config/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2
-20
View File
@@ -1,20 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
spec:
chartRef:
kind: OCIRepository
name: cert-manager
interval: 1h
values:
crds:
enabled: true
replicaCount: #{ 2 if nodes | length > 1 else 1 }#
dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query
dns01RecursiveNameserversOnly: true
prometheus:
enabled: true
servicemonitor:
enabled: true
template/config/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./clusterissuer.yaml
- ./helmrelease.yaml
- ./ocirepository.yaml
#% if dns.provider == 'cloudflare' %#
- ./secret.sops.yaml
#% endif %#
template/config/kubernetes/apps/cert-manager/cert-manager/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: cert-manager
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: v1.21.2
url: oci://quay.io/jetstack/charts/cert-manager
template/config/kubernetes/apps/cert-manager/cert-manager/app/secret.sops.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
#% if dns.provider == 'cloudflare' %#
---
apiVersion: v1
kind: Secret
metadata:
name: cert-manager-secret
stringData:
api-token: "#{ dns.token }#"
#% endif %#
template/config/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
-30
View File
@@ -1,30 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cert-manager
spec:
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
name: cert-manager
namespace: cert-manager
- apiVersion: cert-manager.io/v1
kind: ClusterIssuer
name: #{ cluster_issuer }#
healthCheckExprs:
- apiVersion: cert-manager.io/v1
kind: ClusterIssuer
current: status.conditions.exists(e, e.type == 'Ready' && e.status == 'True')
interval: 1h
path: ./kubernetes/apps/cert-manager/cert-manager/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: cert-manager
template/config/kubernetes/apps/cert-manager/kustomization.yaml.j2
-11
View File
@@ -1,11 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-manager
components:
- ../../components/sops
resources:
- ./namespace.yaml
- ./cert-manager/ks.yaml
template/config/kubernetes/apps/cert-manager/namespace.yaml.j2
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
template/config/kubernetes/apps/default/echo/app/helmrelease.yaml.j2
-31
View File
@@ -1,31 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: echo
spec:
chartRef:
kind: OCIRepository
name: echo
interval: 1h
values:
replicaCount: #{ 2 if nodes | length > 1 else 1 }#
config:
kubernetes: true
trustedProxies:
- "#{ kubernetes.pod_cidr }#"
httpRoute:
enabled: true
hostnames:
- "{{ .Release.Name }}.${SECRET_DOMAIN}"
parentRefs:
- name: envoy-#{ 'external' if ingress.mode != 'none' else 'internal' }#
namespace: network
monitoring:
serviceMonitor:
enabled: true
resources:
requests:
cpu: 10m
limits:
memory: 64Mi
template/config/kubernetes/apps/default/echo/app/kustomization.yaml.j2
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
template/config/kubernetes/apps/default/echo/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: echo
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 0.2.5
url: oci://ghcr.io/home-operations/charts/echo
template/config/kubernetes/apps/default/echo/ks.yaml.j2
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: echo
spec:
interval: 1h
path: ./kubernetes/apps/default/echo/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: default
wait: false
template/config/kubernetes/apps/default/kustomization.yaml.j2
-11
View File
@@ -1,11 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
components:
- ../../components/sops
resources:
- ./namespace.yaml
- ./echo/ks.yaml
template/config/kubernetes/apps/default/namespace.yaml.j2
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: default
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
template/config/kubernetes/apps/flux-system/flux-instance/app/helmrelease.yaml.j2
-136
View File
@@ -1,136 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: flux-instance
spec:
chartRef:
kind: OCIRepository
name: flux-instance
interval: 1h
values:
commonAnnotations:
fluxcd.controlplane.io/reconcileArtifactEvery: 1h
instance:
cluster:
networkPolicy: false
components:
- source-controller
- kustomize-controller
- helm-controller
- notification-controller
sync:
kind: GitRepository
url: "#{ repository.url }#"
#% if repository.url.startswith('ssh://') %#
pullSecret: deploy-key
#% endif %#
ref: "refs/heads/#{ repository.branch }#"
path: kubernetes/flux/cluster
commonMetadata:
labels:
app.kubernetes.io/name: flux
kustomize:
patches:
- # Increase the number of workers
patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --concurrent=10
- op: add
path: /spec/template/spec/containers/0/args/-
value: --requeue-dependency=5s
target:
kind: Deployment
name: (kustomize-controller|helm-controller|source-controller)
- # Increase the memory limits
patch: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: all
spec:
template:
spec:
containers:
- name: manager
resources:
limits:
memory: 1Gi
target:
kind: Deployment
name: (kustomize-controller|helm-controller|source-controller)
- # Enable in-memory kustomize builds
patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --concurrent=20
- op: replace
path: /spec/template/spec/volumes/0
value:
name: temp
emptyDir:
medium: Memory
target:
kind: Deployment
name: kustomize-controller
- # Enable Helm repositories caching
patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --helm-cache-max-size=10
- op: add
path: /spec/template/spec/containers/0/args/-
value: --helm-cache-ttl=60m
- op: add
path: /spec/template/spec/containers/0/args/-
value: --helm-cache-purge-interval=5m
target:
kind: Deployment
name: source-controller
- # Flux near OOM detection for Helm
patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --feature-gates=OOMWatch=true
- op: add
path: /spec/template/spec/containers/0/args/-
value: --oom-watch-memory-threshold=95
- op: add
path: /spec/template/spec/containers/0/args/-
value: --oom-watch-interval=500ms
target:
kind: Deployment
name: helm-controller
- # Disable chart digest tracking
patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --feature-gates=DisableChartDigestTracking=true
target:
kind: Deployment
name: helm-controller
- # Controller-level SOPS decryption
patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --sops-age-secret=sops-age
target:
kind: Deployment
name: kustomize-controller
- # Watch configmaps and secrets attached to HelmReleases and Kustomizations
patch: |-
- op: add
path: /spec/template/spec/containers/0/args/-
value: --watch-configs-label-selector=owner!=helm
target:
kind: Deployment
name: (helm-controller|kustomize-controller)
- # Cancel health checks on new Kustomizations revisions
patch: |-
- op: add
path: /spec/template/spec/containers/0/args/-
value: --feature-gates=CancelHealthCheckOnNewRevision=true
target:
kind: Deployment
name: kustomize-controller
template/config/kubernetes/apps/flux-system/flux-instance/app/httproute.yaml.j2
-22
View File
@@ -1,22 +0,0 @@
#% if repository.webhook_provider != 'none' %#
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: flux-webhook
spec:
hostnames: ["flux-webhook.${SECRET_DOMAIN}"]
parentRefs:
- name: envoy-#{ 'external' if ingress.mode != 'none' else 'internal' }#
namespace: network
sectionName: https
rules:
- backendRefs:
- name: webhook-receiver
namespace: flux-system
port: 80
matches:
- path:
type: PathPrefix
value: /hook/
#% endif %#
template/config/kubernetes/apps/flux-system/flux-instance/app/kustomization.yaml.j2
-11
View File
@@ -1,11 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
#% if repository.webhook_provider != 'none' %#
- ./secret.sops.yaml
- ./httproute.yaml
- ./receiver.yaml
#% endif %#
template/config/kubernetes/apps/flux-system/flux-instance/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: flux-instance
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 0.60.0
url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance
template/config/kubernetes/apps/flux-system/flux-instance/app/receiver.yaml.j2
-21
View File
@@ -1,21 +0,0 @@
#% if repository.webhook_provider != 'none' %#
---
apiVersion: notification.toolkit.fluxcd.io/v1
kind: Receiver
metadata:
name: flux-webhook
spec:
type: #{ repository.webhook_provider }#
events: ["ping", "push"]
secretRef:
name: flux-webhook-token
resources:
- apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
name: flux-system
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
name: flux-system
namespace: flux-system
#% endif %#
template/config/kubernetes/apps/flux-system/flux-instance/app/secret.sops.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
#% if repository.webhook_provider != 'none' %#
---
apiVersion: v1
kind: Secret
metadata:
name: flux-webhook-token
stringData:
token: "#{ webhook_token() }#"
#% endif %#
template/config/kubernetes/apps/flux-system/flux-instance/ks.yaml.j2
-21
View File
@@ -1,21 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-instance
spec:
dependsOn:
- name: flux-operator
interval: 1h
path: ./kubernetes/apps/flux-system/flux-instance/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: flux-system
wait: false
template/config/kubernetes/apps/flux-system/flux-operator/app/helmrelease.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: flux-operator
spec:
chartRef:
kind: OCIRepository
name: flux-operator
interval: 1h
values:
serviceMonitor:
create: true
template/config/kubernetes/apps/flux-system/flux-operator/app/kustomization.yaml.j2
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
template/config/kubernetes/apps/flux-system/flux-operator/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: flux-operator
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 0.60.0
url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
template/config/kubernetes/apps/flux-system/flux-operator/ks.yaml.j2
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-operator
spec:
interval: 1h
path: ./kubernetes/apps/flux-system/flux-operator/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: flux-system
wait: true
template/config/kubernetes/apps/flux-system/kustomization.yaml.j2
-12
View File
@@ -1,12 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: flux-system
components:
- ../../components/sops
resources:
- ./namespace.yaml
- ./flux-instance/ks.yaml
- ./flux-operator/ks.yaml
template/config/kubernetes/apps/flux-system/namespace.yaml.j2
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
template/config/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
-91
View File
@@ -1,91 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
spec:
chartRef:
kind: OCIRepository
name: cilium
interval: 1h
values:
autoDirectNodeRoutes: true
bpf:
masquerade: true
# Ref: https://github.com/siderolabs/talos/issues/10002
hostLegacyRouting: true
#% if cilium_bgp_enabled %#
bgpControlPlane:
enabled: true
#% endif %#
cni:
# Required for pairing with Multus CNI
exclusive: false
cgroup:
automount:
enabled: false
hostRoot: /sys/fs/cgroup
# The stable bond name is defined in talos/all/20-network-links.yaml.tpl
devices: bond0+
dashboards:
enabled: true
endpointRoutes:
enabled: true
envoy:
enabled: false
gatewayAPI:
enabled: false
hubble:
enabled: false
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "#{ kubernetes.pod_cidr }#"
k8sServiceHost: 127.0.0.1
k8sServicePort: 7445
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
enabled: true
loadBalancer:
algorithm: maglev
mode: "#{ cilium.loadbalancer_mode }#"
localRedirectPolicies:
enabled: true
operator:
dashboards:
enabled: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
replicas: #{ 2 if nodes | length > 1 else 1 }#
rollOutPods: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
trustCRDsExist: true
rollOutCiliumPods: true
routingMode: native
securityContext:
capabilities:
ciliumAgent:
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- PERFMON
- BPF
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
cleanCiliumState:
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
socketLB:
enabled: true
template/config/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
- ./networks.yaml
template/config/kubernetes/apps/kube-system/cilium/app/networks.yaml.j2
-71
View File
@@ -1,71 +0,0 @@
---
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: pool
spec:
allowFirstLastIPs: "No"
blocks:
- cidr: "#{ network.node_cidr }#"
---
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
name: l2-policy
spec:
loadBalancerIPs: true
# NOTE: interfaces might need to be set if you have more than one active NIC on your hosts
# interfaces:
# - ^eno[0-9]+
# - ^eth[0-9]+
nodeSelector:
matchLabels:
kubernetes.io/os: linux
#% if cilium_bgp_enabled %#
---
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPAdvertisement
metadata:
name: bgp-advertisement-config
labels:
advertise: bgp
spec:
advertisements:
- advertisementType: Service
service:
addresses:
- LoadBalancerIP
selector:
matchExpressions:
- { key: somekey, operator: NotIn, values: ["never-used-value"] }
---
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPPeerConfig
metadata:
name: bgp-peer-config-v4
spec:
families:
- afi: ipv4
safi: unicast
advertisements:
matchLabels:
advertise: bgp
---
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPClusterConfig
metadata:
name: bgp-cluster-config
spec:
nodeSelector:
matchLabels:
kubernetes.io/os: linux
bgpInstances:
- name: instance-#{ cilium.bgp.node_asn }#
localASN: #{ cilium.bgp.node_asn }#
peers:
- name: peer-#{ cilium.bgp.router_asn }#-v4
peerASN: #{ cilium.bgp.router_asn }#
peerAddress: #{ cilium.bgp.router_addr }#
peerConfigRef:
name: bgp-peer-config-v4
#% endif %#
template/config/kubernetes/apps/kube-system/cilium/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: cilium
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 1.20.1
url: oci://quay.io/cilium/charts/cilium
template/config/kubernetes/apps/kube-system/cilium/ks.yaml.j2
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium
spec:
interval: 1h
path: ./kubernetes/apps/kube-system/cilium/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: kube-system
wait: false
template/config/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
-69
View File
@@ -1,69 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: coredns
spec:
chartRef:
kind: OCIRepository
name: coredns
interval: 1h
values:
fullnameOverride: coredns
image:
repository: mirror.gcr.io/coredns/coredns
k8sAppLabelOverride: kube-dns
serviceAccount:
create: true
service:
name: kube-dns
clusterIP: "#{ kubernetes.coredns_addr }#"
replicaCount: #{ 2 if controller_count > 1 else 1 }#
priorityClassName: system-cluster-critical
servers:
- zones:
- zone: .
scheme: dns://
use_tcp: true
port: 53
plugins:
- name: errors
- name: health
configBlock: |-
lameduck 5s
- name: ready
- name: kubernetes
parameters: cluster.local in-addr.arpa ip6.arpa
configBlock: |-
pods verified
fallthrough in-addr.arpa ip6.arpa
- name: autopath
parameters: "@kubernetes"
- name: forward
parameters: . /etc/resolv.conf
- name: cache
configBlock: |-
prefetch 20
serve_stale
servfail 0
- name: loop
- name: reload
- name: loadbalance
- name: prometheus
parameters: 0.0.0.0:9153
- name: log
configBlock: |-
class error
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
template/config/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
template/config/kubernetes/apps/kube-system/coredns/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: coredns
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
url: oci://ghcr.io/coredns/charts/coredns
ref:
tag: 1.47.1
template/config/kubernetes/apps/kube-system/coredns/ks.yaml.j2
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: coredns
spec:
interval: 1h
path: ./kubernetes/apps/kube-system/coredns/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: kube-system
wait: false
template/config/kubernetes/apps/kube-system/kustomization.yaml.j2
-17
View File
@@ -1,17 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
components:
- ../../components/sops
resources:
- ./namespace.yaml
- ./cilium/ks.yaml
- ./coredns/ks.yaml
- ./metrics-server/ks.yaml
- ./reloader/ks.yaml
#% if spegel.enabled %#
- ./spegel/ks.yaml
#% endif %#
template/config/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2
-21
View File
@@ -1,21 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metrics-server
spec:
chartRef:
kind: OCIRepository
name: metrics-server
interval: 1h
values:
args:
- --kubelet-insecure-tls
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=10s
- --kubelet-request-timeout=2s
metrics:
enabled: true
serviceMonitor:
enabled: true
template/config/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
template/config/kubernetes/apps/kube-system/metrics-server/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: metrics-server
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 3.14.0
url: oci://ghcr.io/home-operations/charts-mirror/metrics-server
template/config/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: metrics-server
spec:
interval: 1h
path: ./kubernetes/apps/kube-system/metrics-server/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: kube-system
wait: false
template/config/kubernetes/apps/kube-system/namespace.yaml.j2
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
annotations:
kustomize.toolkit.fluxcd.io/prune: disabled
template/config/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2
-17
View File
@@ -1,17 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: reloader
spec:
chartRef:
kind: OCIRepository
name: reloader
interval: 1h
values:
fullnameOverride: reloader
reloader:
readOnlyRootFileSystem: true
podMonitor:
enabled: true
namespace: "{{ .Release.Namespace }}"
template/config/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./ocirepository.yaml
template/config/kubernetes/apps/kube-system/reloader/app/ocirepository.yaml.j2
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: reloader
spec:
interval: 15m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 2.2.17
url: oci://ghcr.io/stakater/charts/reloader
template/config/kubernetes/apps/kube-system/reloader/ks.yaml.j2
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: reloader
spec:
interval: 1h
path: ./kubernetes/apps/kube-system/reloader/app
postBuild:
substituteFrom:
- name: cluster-secrets
kind: Secret
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: kube-system
wait: false

Some files were not shown because too many files have changed in this diff Show More