fix: set enforce:privileged for Cilium compatibility
This commit is contained in:
@@ -1,188 +1,183 @@
|
||||
# ─── fastpass Talos Cluster Configuration ────────────────────────────────────
|
||||
# Managed by talhelper on city-hall (10.1.71.38)
|
||||
# Generate configs: talhelper genconfig
|
||||
# Generate secrets: talhelper gensecret > talenv.yaml && sops -e -i talenv.yaml
|
||||
# Apply configs: talhelper gencommand apply | bash
|
||||
# Bootstrap: talhelper gencommand bootstrap | bash
|
||||
# cluster: fastpass
|
||||
# managed by: talhelper on city-hall (10.1.71.38)
|
||||
# repo: talos/talhelper/ in rblundon/homelab on mad-tea-party
|
||||
#
|
||||
# Quickref:
|
||||
# talhelper genconfig # regenerate clusterconfig/
|
||||
# talhelper gencommand apply --extra-flags="--insecure" | bash
|
||||
# talhelper gencommand bootstrap | bash
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
clusterName: fastpass
|
||||
talosVersion: v1.13.2
|
||||
kubernetesVersion: v1.32.3
|
||||
|
||||
# ─── Cluster Endpoint ────────────────────────────────────────────────────────
|
||||
# Points at the Talos native VIP (10.1.71.65) which floats across
|
||||
# control plane nodes. All kubectl and talosctl traffic goes here.
|
||||
# VIP floats across control plane nodes — all kubectl/talosctl traffic lands here
|
||||
endpoint: https://10.1.71.65:6443
|
||||
|
||||
# ─── Domain ──────────────────────────────────────────────────────────────────
|
||||
domain: cluster.local
|
||||
|
||||
# ─── CNI ─────────────────────────────────────────────────────────────────────
|
||||
# Cilium is installed post-bootstrap via Helm.
|
||||
# Talos ships with flannel by default — disable it so Cilium takes over.
|
||||
cniConfig:
|
||||
name: none
|
||||
|
||||
# ─── Patches applied to ALL nodes ────────────────────────────────────────────
|
||||
# ─── Cluster-wide patches ────────────────────────────────────────────────────
|
||||
patches:
|
||||
- |-
|
||||
cluster:
|
||||
# CRITICAL: enforce:privileged is required for Cilium.
|
||||
# The default (enforce:baseline) blocks the capabilities Cilium needs
|
||||
# (NET_ADMIN, NET_RAW, SYS_ADMIN). This was the root cause of the
|
||||
# broken cluster. Do not change this back to baseline.
|
||||
apiServer:
|
||||
admissionControl:
|
||||
- name: PodSecurity
|
||||
configuration:
|
||||
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
||||
kind: PodSecurityConfiguration
|
||||
defaults:
|
||||
enforce: "privileged"
|
||||
enforce-version: "latest"
|
||||
audit: "restricted"
|
||||
audit-version: "latest"
|
||||
warn: "restricted"
|
||||
warn-version: "latest"
|
||||
exemptions:
|
||||
usernames: []
|
||||
runtimeClasses: []
|
||||
namespaces:
|
||||
- kube-system
|
||||
- argocd
|
||||
- cert-manager
|
||||
- ingress-nginx
|
||||
- external-secrets
|
||||
|
||||
- |-
|
||||
machine:
|
||||
time:
|
||||
servers:
|
||||
- 10.1.71.21
|
||||
sysctls:
|
||||
net.ipv4.ip_forward: "1"
|
||||
kernel:
|
||||
modules:
|
||||
- name: br_netfilter
|
||||
- name: ip_tables
|
||||
- 10.1.71.21 # sundial — local NTP
|
||||
|
||||
# DNS search domain so short names resolve inside the cluster
|
||||
network:
|
||||
extraHostEntries: []
|
||||
|
||||
# Talos manages kubelet — these flags are additive
|
||||
kubelet:
|
||||
extraArgs:
|
||||
rotate-server-certificates: "true"
|
||||
rotate-server-certificates: true
|
||||
|
||||
# Feature gates — enable Gateway API support for Cilium's secondary ingress
|
||||
features:
|
||||
kubePrism:
|
||||
enabled: true
|
||||
port: 7445
|
||||
|
||||
# ─── Control plane patches ───────────────────────────────────────────────────
|
||||
controlPlane:
|
||||
patches:
|
||||
- |-
|
||||
cluster:
|
||||
etcd:
|
||||
advertisedSubnets:
|
||||
- 10.1.71.0/24
|
||||
# Allow control plane nodes to schedule workloads (3-node CP on small cluster)
|
||||
scheduler:
|
||||
config:
|
||||
apiVersion: kubescheduler.config.k8s.io/v1
|
||||
kind: KubeSchedulerConfiguration
|
||||
profiles:
|
||||
- schedulerName: default-scheduler
|
||||
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
# VIP — floats across all three control plane nodes
|
||||
# Talos handles VIP natively; no keepalived needed
|
||||
interfaces:
|
||||
- interface: eth0
|
||||
vip:
|
||||
ip: 10.1.71.65
|
||||
|
||||
# ─── Nodes ───────────────────────────────────────────────────────────────────
|
||||
|
||||
nodes:
|
||||
|
||||
# ── Control Plane ──────────────────────────────────────────────────────────
|
||||
|
||||
# ── Control plane ──────────────────────────────────────────────────────────
|
||||
- hostname: space-mountain
|
||||
ipAddress: 10.1.71.66
|
||||
controlPlane: true
|
||||
installDisk: /dev/sda
|
||||
networkInterfaces:
|
||||
- interface: ens18
|
||||
- interface: eth0
|
||||
addresses:
|
||||
- 10.1.71.66/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.1.71.1
|
||||
dhcp: false
|
||||
vip:
|
||||
ip: 10.1.71.65
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 10.1.71.32
|
||||
|
||||
- hostname: big-thunder-mountain
|
||||
ipAddress: 10.1.71.67
|
||||
controlPlane: true
|
||||
installDisk: /dev/sda
|
||||
networkInterfaces:
|
||||
- interface: ens18
|
||||
- interface: eth0
|
||||
addresses:
|
||||
- 10.1.71.67/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.1.71.1
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 10.1.71.32
|
||||
dhcp: false
|
||||
vip:
|
||||
ip: 10.1.71.65
|
||||
|
||||
- hostname: splash-mountain
|
||||
ipAddress: 10.1.71.68
|
||||
controlPlane: true
|
||||
installDisk: /dev/sda
|
||||
networkInterfaces:
|
||||
- interface: ens18
|
||||
- interface: eth0
|
||||
addresses:
|
||||
- 10.1.71.68/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.1.71.1
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 10.1.71.32
|
||||
dhcp: false
|
||||
vip:
|
||||
ip: 10.1.71.65
|
||||
|
||||
# ── Workers ────────────────────────────────────────────────────────────────
|
||||
|
||||
- hostname: jungle-cruise
|
||||
ipAddress: 10.1.71.69
|
||||
controlPlane: false
|
||||
installDisk: /dev/sda
|
||||
networkInterfaces:
|
||||
- interface: ens18
|
||||
- interface: eth0
|
||||
addresses:
|
||||
- 10.1.71.69/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.1.71.1
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 10.1.71.32
|
||||
dhcp: false
|
||||
|
||||
- hostname: haunted-mansion
|
||||
ipAddress: 10.1.71.70
|
||||
controlPlane: false
|
||||
installDisk: /dev/sda
|
||||
networkInterfaces:
|
||||
- interface: ens18
|
||||
- interface: eth0
|
||||
addresses:
|
||||
- 10.1.71.70/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.1.71.1
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 10.1.71.32
|
||||
dhcp: false
|
||||
|
||||
- hostname: peter-pans-flight
|
||||
ipAddress: 10.1.71.71
|
||||
controlPlane: false
|
||||
installDisk: /dev/sda
|
||||
networkInterfaces:
|
||||
- interface: ens18
|
||||
- interface: eth0
|
||||
addresses:
|
||||
- 10.1.71.71/24
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
gateway: 10.1.71.1
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
- 10.1.71.32
|
||||
|
||||
# ─── Control Plane Config ────────────────────────────────────────────────────
|
||||
controlPlane:
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
features:
|
||||
kubernetesTalosAPIAccess:
|
||||
enabled: true
|
||||
allowedRoles:
|
||||
- os:reader
|
||||
allowedKubernetesNamespaces:
|
||||
- kube-system
|
||||
cluster:
|
||||
etcd:
|
||||
advertisedSubnets:
|
||||
- 10.1.71.64/26
|
||||
coreDNS:
|
||||
disabled: false
|
||||
proxy:
|
||||
disabled: true
|
||||
|
||||
# ─── Worker Config ───────────────────────────────────────────────────────────
|
||||
worker:
|
||||
patches:
|
||||
- |-
|
||||
machine:
|
||||
kubelet:
|
||||
extraArgs: {}
|
||||
dhcp: false
|
||||
|
||||
Reference in New Issue
Block a user