# ─── fastpass Talos Cluster Configuration ──────────────────────────────────── # cluster: fastpass # managed by: talhelper on city-hall (10.1.71.38) # repo: talos/talhelper/ in rblundon/homelab on mad-tea-party # # Quickref: # talhelper genconfig # regenerate clusterconfig/ # talhelper gencommand apply --extra-flags="--insecure" | bash # talhelper gencommand bootstrap | bash # ───────────────────────────────────────────────────────────────────────────── clusterName: fastpass talosVersion: v1.13.2 kubernetesVersion: v1.32.3 # VIP floats across control plane nodes — all kubectl/talosctl traffic lands here endpoint: https://10.1.71.65:6443 # ─── Cluster-wide patches ──────────────────────────────────────────────────── patches: - |- cluster: # CRITICAL: enforce:privileged is required for Cilium. # The default (enforce:baseline) blocks the capabilities Cilium needs # (NET_ADMIN, NET_RAW, SYS_ADMIN). This was the root cause of the # broken cluster. Do not change this back to baseline. apiServer: admissionControl: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 kind: PodSecurityConfiguration defaults: enforce: "privileged" enforce-version: "latest" audit: "restricted" audit-version: "latest" warn: "restricted" warn-version: "latest" exemptions: usernames: [] runtimeClasses: [] namespaces: - argocd - cert-manager - ingress-nginx - external-secrets - |- machine: time: servers: - 10.1.71.21 # sundial — local NTP # Sysctls required for Cilium eBPF on Talos # bpf_jit_harden: 2 (Talos default) blocks Cilium's eBPF programs # unprivileged_bpf_disabled: 1 (Talos default) blocks BPF for unprivileged containers # perf_event_paranoid: 3 (Talos default) too restrictive for Cilium observability sysctls: net.core.bpf_jit_harden: "0" kernel.unprivileged_bpf_disabled: "0" kernel.perf_event_paranoid: "1" # DNS — point at world-drive (UDM Pro), which forwards local.mk-labs.cloud # to monorail and handles external resolution via DoH network: nameservers: - 10.1.71.1 extraHostEntries: [] # Talos manages kubelet — these flags are additive kubelet: extraArgs: rotate-server-certificates: true # Feature gates — enable Gateway API support for Cilium's secondary ingress features: kubePrism: enabled: true port: 7445 # ─── Control plane patches ─────────────────────────────────────────────────── controlPlane: schematic: customization: systemExtensions: officialExtensions: - siderolabs/qemu-guest-agent patches: - |- cluster: etcd: advertisedSubnets: - 10.1.71.0/24 # Allow control plane nodes to schedule workloads (3-node CP on small cluster) scheduler: config: apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration profiles: - schedulerName: default-scheduler - |- machine: network: # VIP — floats across all three control plane nodes # Talos handles VIP natively; no keepalived needed interfaces: - interface: ens18 vip: ip: 10.1.71.65 # ─── Worker patches ────────────────────────────────────────────────────────── worker: schematic: customization: systemExtensions: officialExtensions: - siderolabs/qemu-guest-agent - siderolabs/util-linux-tools - siderolabs/iscsi-tools patches: - |- machine: # Load required kernel modules for iSCSI and multipath kernel: modules: - name: iscsi_tcp - name: dm_multipath - name: dm_round_robin # CRITICAL: Explicitly set nodeIP to primary network to avoid dual-NIC issues # Workers have ens18 (10.1.71.x) for K8s traffic and ens19 (10.1.75.x) for iSCSI kubelet: nodeIP: validSubnets: - 10.1.71.0/24 extraMounts: # Only mount /var/lib/iscsi (NOT /etc/iscsi) # The iscsi-tools extension manages /etc/iscsi automatically # /var/lib/iscsi contains iSCSI session and node data that must persist - destination: /var/lib/iscsi type: bind source: /var/lib/iscsi options: - bind - rshared - rw # ARP tuning for dual-NIC setup sysctls: net.ipv4.conf.all.arp_announce: "2" net.ipv4.conf.all.arp_ignore: "1" - |- machine: files: - path: /etc/multipath.conf permissions: 0644 op: create content: | # Multipath configuration for Pure Storage FlashArray defaults { polling_interval 10 find_multipaths yes user_friendly_names no } devices { device { vendor "PURE" product "FlashArray" path_selector "service-time 0" path_grouping_policy group_by_prio prio alua path_checker tur fast_io_fail_tmo 10 user_friendly_names no no_path_retry 0 hardware_handler "1 alua" dev_loss_tmo 600 failback immediate } } blacklist { devnode "^pxd[0-9]*" devnode "^pxd.*" } # ─── Nodes ─────────────────────────────────────────────────────────────────── nodes: # ── Control plane ────────────────────────────────────────────────────────── - hostname: space-mountain ipAddress: 10.1.71.66 controlPlane: true installDisk: /dev/sda networkInterfaces: - interface: ens18 addresses: - 10.1.71.66/24 routes: - network: 0.0.0.0/0 gateway: 10.1.71.1 dhcp: false vip: ip: 10.1.71.65 - hostname: big-thunder-mountain ipAddress: 10.1.71.67 controlPlane: true installDisk: /dev/sda networkInterfaces: - interface: ens18 addresses: - 10.1.71.67/24 routes: - network: 0.0.0.0/0 gateway: 10.1.71.1 dhcp: false vip: ip: 10.1.71.65 - hostname: splash-mountain ipAddress: 10.1.71.68 controlPlane: true installDisk: /dev/sda networkInterfaces: - interface: ens18 addresses: - 10.1.71.68/24 routes: - network: 0.0.0.0/0 gateway: 10.1.71.1 dhcp: false vip: ip: 10.1.71.65 # ── Workers ──────────────────────────────────────────────────────────────── - hostname: jungle-cruise ipAddress: 10.1.71.69 controlPlane: false installDisk: /dev/sda networkInterfaces: - interface: ens18 addresses: - 10.1.71.69/24 routes: - network: 0.0.0.0/0 gateway: 10.1.71.1 dhcp: false - interface: ens19 # iSCSI storage network addresses: - 10.1.75.69/24 dhcp: false - hostname: haunted-mansion ipAddress: 10.1.71.70 controlPlane: false installDisk: /dev/sda networkInterfaces: - interface: ens18 addresses: - 10.1.71.70/24 routes: - network: 0.0.0.0/0 gateway: 10.1.71.1 dhcp: false - interface: ens19 # iSCSI storage network addresses: - 10.1.75.70/24 dhcp: false - hostname: peter-pans-flight ipAddress: 10.1.71.71 controlPlane: false installDisk: /dev/sda networkInterfaces: - interface: ens18 addresses: - 10.1.71.71/24 routes: - network: 0.0.0.0/0 gateway: 10.1.71.1 dhcp: false - interface: ens19 # iSCSI storage network addresses: - 10.1.75.71/24 dhcp: false