Initial commit

.github/template-tests/invalid/bad-bgp-asn.toml

@@ -0,0 +1,34 @@
+# Negative fixture: BGP router ASN above the 32-bit ASN range.
+# Expected to be rejected by _router_asn_in_range.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[cilium.bgp]
+router_addr = "10.10.1.1"
+router_asn  = "4294967296"
+node_asn    = "64514"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/bad-mac-address.toml

@@ -0,0 +1,29 @@
+# Negative fixture: malformed MAC address (uppercase + missing colons).
+# Expected to be rejected by the #Node.mac_addr regex constraint.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "AABBCCDDEEFF"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/bad-repo-url.toml

@@ -0,0 +1,30 @@
+# Negative fixture: scp-style git URL ("git@host:owner/repo.git") instead of
+# the canonical https:// or ssh://git@ form.
+# Expected to be rejected by the repository.url pattern.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "git@github.com:onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/bad-vlan-tag.toml

@@ -0,0 +1,30 @@
+# Negative fixture: vlan_tag outside the valid 1-4094 range.
+# Expected to be rejected by _vlan_tag_in_range.
+[network]
+node_cidr = "10.10.10.0/24"
+vlan_tag  = "5000"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/duplicate-gateway-addrs.toml

@@ -0,0 +1,29 @@
+# Negative fixture: gateways.internal == gateways.dns.
+# Expected to be rejected by `_addrs_check` (list.UniqueItems).
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.252"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/duplicate-node-names.toml

@@ -0,0 +1,37 @@
+# Negative fixture: two nodes with the same name.
+# Expected to be rejected by `_node_name_check` (list.UniqueItems).
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.101"
+controller   = false
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:01"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/gateway-node-collision.toml

@@ -0,0 +1,29 @@
+# Negative fixture: a node reuses the internal gateway VIP.
+# Expected to be rejected by _addr_uniqueness_check.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.252"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/missing-dns-token.toml

@@ -0,0 +1,29 @@
+# Negative fixture: dns.provider "cloudflare" (the default) without a token.
+# Expected to be rejected by the Dns validator.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[domain]
+name = "example.com"
+
+[dns]
+provider = "cloudflare"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/missing-external-gateway.toml

@@ -0,0 +1,28 @@
+# Negative fixture: cloudflare-tunnel ingress without gateways.external.
+# Expected to be rejected by the Config cross-check.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/missing-known-hosts.toml

@@ -0,0 +1,30 @@
+# Negative fixture: ssh:// URL to a host without bundled SSH host keys
+# (github.com/gitlab.com/codeberg.org) and no repository.known_hosts set.
+# Expected to be rejected by the conditional known_hosts constraint.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "ssh://git@git.example.com/k8s/home-ops.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/missing-schematic.toml

@@ -0,0 +1,28 @@
+# Negative fixture: a node without schematic_id and no [talos] default.
+# Expected to be rejected by the schematic resolution in Config.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[[nodes]]
+name       = "k8s-0"
+address    = "10.10.10.100"
+controller = true
+disk       = "/dev/sdfake"
+mac_addr   = "00:00:00:00:00:00"

.github/template-tests/invalid/nested-cidr-overlap.toml

@@ -0,0 +1,30 @@
+# Negative fixture: node_cidr is nested inside the default pod_cidr
+# (10.42.0.0/16) without being string-equal to it.
+# Expected to be rejected by _cidr_overlap_check.
+[network]
+node_cidr = "10.42.128.0/17"
+
+[kubernetes.api]
+addr = "10.42.128.254"
+
+[gateways]
+internal = "10.42.128.252"
+dns      = "10.42.128.253"
+external = "10.42.128.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.42.128.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/node-addr-outside-cidr.toml

@@ -0,0 +1,29 @@
+# Negative fixture: node address is not inside network.node_cidr.
+# Expected to be rejected by _node_addrs_in_node_cidr.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "192.168.1.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/node-uses-gateway-addr.toml

@@ -0,0 +1,30 @@
+# Negative fixture: a node claims the default gateway address (defaults to
+# the first IP in node_cidr).
+# Expected to be rejected by _addr_uniqueness_check.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.1"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/non-canonical-cidr.toml

@@ -0,0 +1,30 @@
+# Negative fixture: node_cidr written with host bits set instead of the
+# network address.
+# Expected to be rejected by _cidr_canonical_check.
+[network]
+node_cidr = "10.10.10.5/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/overlapping-cidrs.toml

@@ -0,0 +1,29 @@
+# Negative fixture: network.node_cidr overlaps the default kubernetes.pod_cidr (10.42.0.0/16).
+# Expected to be rejected by `_cidrs_check` (list.UniqueItems).
+[network]
+node_cidr = "10.42.0.0/16"
+
+[kubernetes.api]
+addr = "10.42.0.254"
+
+[gateways]
+internal = "10.42.0.252"
+dns      = "10.42.0.253"
+external = "10.42.0.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.42.0.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/partial-bgp.toml

@@ -0,0 +1,34 @@
+# Negative fixture: two of the three BGP fields set; previously this
+# silently left BGP disabled.
+# Expected to be rejected by the Bgp all-or-nothing check.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[cilium.bgp]
+router_addr = "10.10.1.1"
+router_asn  = "64513"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/reserved-node-name.toml

@@ -0,0 +1,29 @@
+# Negative fixture: a node name uses the reserved word "controller".
+# Expected to be rejected by the #Node.name regex constraint.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "controller"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/tiny-svc-cidr.toml

@@ -0,0 +1,33 @@
+# Negative fixture: svc_cidr too small to contain the derived CoreDNS
+# address (10th IP).
+# Expected to be rejected by _coredns_addr_in_svc_cidr.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes]
+svc_cidr = "10.43.0.0/29"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[domain]
+name = "example.com"
+
+[dns]
+token = "fake"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"

.github/template-tests/invalid/tunnel-without-dns.toml

@@ -0,0 +1,32 @@
+# Negative fixture: cloudflare-tunnel ingress with dns.provider "none".
+# Expected to be rejected by the Config cross-check.
+[network]
+node_cidr = "10.10.10.0/24"
+
+[kubernetes.api]
+addr = "10.10.10.254"
+
+[gateways]
+internal = "10.10.10.252"
+dns      = "10.10.10.253"
+external = "10.10.10.251"
+
+[domain]
+name = "example.com"
+
+[dns]
+provider = "none"
+
+[ingress]
+mode = "cloudflare-tunnel"
+
+[repository]
+url = "https://github.com/onedr0p/cluster-template.git"
+
+[[nodes]]
+name         = "k8s-0"
+address      = "10.10.10.100"
+controller   = true
+disk         = "/dev/sdfake"
+mac_addr     = "00:00:00:00:00:00"
+schematic_id = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"