cilium, argo

talos/talhelper/talconfig.yaml

@@ -41,7 +41,6 @@ patches:
                 usernames: []
                 runtimeClasses: []
                 namespaces:
-                  - kube-system
                   - argocd
                   - cert-manager
                   - ingress-nginx
@@ -53,8 +52,20 @@ patches:
         servers:
           - 10.1.71.21   # sundial — local NTP
 
-      # DNS search domain so short names resolve inside the cluster
+      # Sysctls required for Cilium eBPF on Talos
+      # bpf_jit_harden: 2 (Talos default) blocks Cilium's eBPF programs
+      # unprivileged_bpf_disabled: 1 (Talos default) blocks BPF for unprivileged containers
+      # perf_event_paranoid: 3 (Talos default) too restrictive for Cilium observability
+      sysctls:
+        net.core.bpf_jit_harden: "0"
+        kernel.unprivileged_bpf_disabled: "0"
+        kernel.perf_event_paranoid: "1"
+
+      # DNS — point at world-drive (UDM Pro), which forwards local.mk-labs.cloud
+      # to monorail and handles external resolution via DoH
       network:
+        nameservers:
+          - 10.1.71.1
         extraHostEntries: []
 
       # Talos manages kubelet — these flags are additive
@@ -90,7 +101,7 @@ controlPlane:
           # VIP — floats across all three control plane nodes
           # Talos handles VIP natively; no keepalived needed
           interfaces:
-            - interface: eth0
+            - interface: ens18
               vip:
                 ip: 10.1.71.65
 
@@ -102,7 +113,7 @@ nodes:
     controlPlane: true
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.66/24
         routes:
@@ -117,7 +128,7 @@ nodes:
     controlPlane: true
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.67/24
         routes:
@@ -132,7 +143,7 @@ nodes:
     controlPlane: true
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.68/24
         routes:
@@ -148,7 +159,7 @@ nodes:
     controlPlane: false
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.69/24
         routes:
@@ -161,7 +172,7 @@ nodes:
     controlPlane: false
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.70/24
         routes:
@@ -174,7 +185,7 @@ nodes:
     controlPlane: false
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.71/24
         routes: