# ─── fastpass Talos Cluster Configuration ────────────────────────────────────
# Managed by talhelper on city-hall (10.1.71.38)
# Generate configs:  talhelper genconfig
# Generate secrets:  talhelper gensecret > talenv.yaml && sops -e -i talenv.yaml
# Apply configs:     talhelper gencommand apply | bash
# Bootstrap:         talhelper gencommand bootstrap | bash

clusterName: fastpass
talosVersion: v1.13.2
kubernetesVersion: v1.32.3

# ─── Cluster Endpoint ────────────────────────────────────────────────────────
# Points at the Talos native VIP (10.1.71.65) which floats across
# control plane nodes. All kubectl and talosctl traffic goes here.
endpoint: https://10.1.71.65:6443

# ─── Domain ──────────────────────────────────────────────────────────────────
domain: cluster.local

# ─── CNI ─────────────────────────────────────────────────────────────────────
# Cilium is installed post-bootstrap via Helm.
# Talos ships with flannel by default — disable it so Cilium takes over.
cniConfig:
  name: none

# ─── Patches applied to ALL nodes ────────────────────────────────────────────
patches:
  - |-
    machine:
      time:
        servers:
          - 10.1.71.21
      sysctls:
        net.ipv4.ip_forward: "1"
      kernel:
        modules:
          - name: br_netfilter
          - name: ip_tables
      kubelet:
        extraArgs:
          rotate-server-certificates: "true"

# ─── Nodes ───────────────────────────────────────────────────────────────────

nodes:

  # ── Control Plane ──────────────────────────────────────────────────────────

  - hostname: space-mountain
    ipAddress: 10.1.71.66
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.66/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        vip:
          ip: 10.1.71.65
    patches:
      - |-
        machine:
          network:
            nameservers:
              - 10.1.71.32

  - hostname: big-thunder-mountain
    ipAddress: 10.1.71.67
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.67/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
    patches:
      - |-
        machine:
          network:
            nameservers:
              - 10.1.71.32

  - hostname: splash-mountain
    ipAddress: 10.1.71.68
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.68/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
    patches:
      - |-
        machine:
          network:
            nameservers:
              - 10.1.71.32

  # ── Workers ────────────────────────────────────────────────────────────────

  - hostname: jungle-cruise
    ipAddress: 10.1.71.69
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.69/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
    patches:
      - |-
        machine:
          network:
            nameservers:
              - 10.1.71.32

  - hostname: haunted-mansion
    ipAddress: 10.1.71.70
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.70/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
    patches:
      - |-
        machine:
          network:
            nameservers:
              - 10.1.71.32

  - hostname: peter-pans-flight
    ipAddress: 10.1.71.71
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.71/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
    patches:
      - |-
        machine:
          network:
            nameservers:
              - 10.1.71.32

# ─── Control Plane Config ────────────────────────────────────────────────────
controlPlane:
  patches:
    - |-
      machine:
        features:
          kubernetesTalosAPIAccess:
            enabled: true
            allowedRoles:
              - os:reader
            allowedKubernetesNamespaces:
              - kube-system
      cluster:
        etcd:
          advertisedSubnets:
            - 10.1.71.64/26
        coreDNS:
          disabled: false
        proxy:
          disabled: true

# ─── Worker Config ───────────────────────────────────────────────────────────
worker:
  patches:
    - |-
      machine:
        kubelet:
          extraArgs: {}